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Why GAO Did This Study 


Federal agencies that employ law 
enforcement officers can use facial 
recognition technology to assist 
criminal investigations, among other 
activities. For example, the technology 
can help identify an unknown individual 
in a photo or video surveillance. 


GAO was asked to review federal law 
enforcement use of facial recognition 
technology. This report examines the 
1) ownership and use of facial 
recognition technology by federal 
agencies that employ law enforcement 
officers, 2) types of activities these 
agencies use the technology to 
support, and 3) the extent that these 
agencies track employee use of facial 
recognition technology owned by non- 
federal entities. 


GAO administered a survey 
questionnaire to 42 federal agencies 
that employ law enforcement officers 
regarding their use of the technology. 
GAO also reviewed documents (e.g., 
system descriptions) and interviewed 
officials from selected agencies (e.g., 
agencies that owned facial recognition 
technology). This is a public version of 
a sensitive report that GAO issued in 
April 2021. Information that agencies 
deemed sensitive has been omitted. 


What GAO Recommends 


GAO is making two recommendations 
to each of 13 federal agencies to 
implement a mechanism to track what 
non-federal systems are used by 
employees, and assess the risks of 
using these systems. Twelve agencies 
concurred with both recommendations. 
U.S. Postal Service concurred with one 
and partially concurred with the other. 
GAO continues to believe the 
recommendation is valid, as described 
in the report. 
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or goodwing@gao.gov. 


FACIAL RECOGNITION TECHNOLOGY 


Federal Law Enforcement Agencies Should Better 
Assess Privacy and Other Risks 


What GAO Found 


GAO surveyed 42 federal agencies that employ law enforcement officers about 
their use of facial recognition technology. Twenty reported owning systems with 
facial recognition technology or using systems owned by other entities, such as 
other federal, state, local, and non-government entities (see figure). 
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Agencies reported using the technology to support several activities (e.g., 
criminal investigations) and in response to COVID-19 (e.g., verify an individual’s 
identity remotely). Six agencies reported using the technology on images of the 
unrest, riots, or protests following the death of George Floyd in May 2020. Three 
agencies reported using it on images of the events at the U.S. Capitol on January 
6, 2021. Agencies said the searches used images of suspected criminal activity. 


All fourteen agencies that reported using the technology to support criminal 
investigations also reported using systems owned by non-federal entities. 
However, only one has awareness of what non-federal systems are used by 
employees. By having a mechanism to track what non-federal systems are used 
by employees and assessing related risks (e.g., privacy and accuracy-related 
risks), agencies can better mitigate risks to themselves and the public. 
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GAO 1 O O U.S. GOVERNMENT ACCOUNTABILITY OFFICE 
\ A Century of Non-Partisan Fact-Based Work 

441 G St. N.W. 

Washington, DC 20548 


June 3, 2021 
Congressional Requesters 


Of all the technologies used to identify people based on their biological 
and behavioral characteristics, facial recognition most closely mimics how 
people identify others: by examining their face. Law enforcement can use 
facial recognition technology to assist criminal investigations, among 
other activities. For example, the technology can help identify an 
unknown individual from a photo or image from video surveillance. There 
are multiple ways to access the technology. Law enforcement may own 
facial recognition technology, or use technology that is owned by another 
entity (e.g., federal, state, or non-government entity). However, with use 
of facial recognition technology expanding, members of Congress and 
academics have highlighted the importance of understanding what 
technologies are owned and how they are used by federal law 
enforcement. 


We previously examined aspects of federal agencies’ use of facial 
recognition technology. In September 2020, we reported the U.S. 
Customs and Border Protection’s (CBP) and Transportation Security 
Administration’s (TSA) use of the technology at U.S. ports of entry." In 
May 2016, we reported on the Federal Bureau of Investigation’s (FBI) use 
of facial recognition technology.? 


You asked us to review federal law enforcement use of facial recognition 
technology. This report examines: 


1) what federal agencies that employ law enforcement officers own 
and use facial recognition technology; 





1GAO, Facial Recognition: CBP and TSA are Taking Steps to Implement Programs, but 
CBP Should Address Privacy and System Performance Issues, GAO-20-568 
(Washington, D.C.: September 2, 2020). In this report, GAO made five recommendations 
to CBP related to its use of facial recognition technology. The Department of Homeland 
Security concurred with our recommendations, but as of April 2021, has not implemented 
them. 


2GAO, Face Recognition Technology: FBI Should Better Ensure Privacy and Accuracy, 
GAO-16-267 (Washington, D.C.: May 16, 2016). In this report, we made six 
recommendations related to accuracy and privacy regarding the FBI’s use of facial 
recognition technology. The Department of Justice has addressed all six 
recommendations. 
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2) the type of activities these federal agencies use facial recognition 
technology to support; and 


3) the extent that these federal agencies track employee use of facial 
recognition technology owned by non-federal entities, including 
state, local, tribal, territorial, and non-government entities. 


This report is a public version of a sensitive report that we issued in April 
2021.3 Some federal agencies deemed information in our April report to 
be sensitive, which must be protected from public disclosure. Therefore, 
this report omits sensitive information about agency ownership and use of 
facial recognition technology. Although the information provided in this 
report is more limited, the report addresses the same objectives as the 
sensitive report and uses the same methodology. 


To address all three objectives, we surveyed 42 federal agencies that 
employ law enforcement officers. Consistent with our prior work, we 
define federal law enforcement officers as full-time employees with 
federal arrest authority and who are authorized to carry firearms while on 
duty. To identify which agencies employ federal law enforcement officers, 
we reviewed the Bureau of Justice Statistics’ 2016 Census of Federal 
Law Enforcement Officers.4 We included 42 of the 86 agencies identified 
in the 2016 census in our survey population. See appendix | for a list of 
the 42 federal agencies we surveyed, and information about why we 
selected 42 of the 86 agencies in the 2016 census. 


To answer our first and second objectives, we administered a survey 
questionnaire to each of these 42 federal agencies. The questionnaire 
asked agencies whether at any point from January 2015 through March 
2020, they owned a system with facial recognition technology, including 


3GAO, Facial Recognition Technology: Federal Law Enforcement Agencies Should Better 
Assess Privacy and Other Risks, GAO-21-243SU (Washington, D.C.: April 28, 2021). 


4Bureau of Justice Statistics, Federal Law Enforcement Officers, 2016 — Statistical Tables, 
NCJ 251922 (Washington, D.C.: October 2019). 
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systems in the process of being developed.5 The questionnaire asked 
agencies that owned a system to complete additional questions, such as 
the operational status of the system. In addition, we asked agencies 
whether at any point from April 2018 through March 2020, they used 
facial recognition technology owned by another entity.6 We requested 
additional information, through interviews and written requests, from 
agencies that reported in their questionnaire that they owned or used 
facial recognition technology. For example, if an agency reported having 
a system in operation, we requested privacy impact assessments and 
system descriptions. 


To answer our third objective, we reviewed statutes and regulations, such 
as the Privacy Act of 1974. In addition, we interviewed or requested 
information from officials from 14 agencies that reported using (1) non- 
federal systems, and (2) facial recognition technology to support criminal 
investigations. We asked these officials about their process for gathering 
information on what non-federal systems are used by employees, and 
compared this information against our risk management framework and 
key aspects of Standards for Internal Control in the Federal Government 


5We used this time frame because March 2020 was the most recent full month for which 
information was available when we issued our questionnaire. Also, using a 5-year period 
allowed us to identify technology that was recently developed but not put in operation, and 
identify trends in facial recognition search data. In our questionnaire, we stated that the 
term “own” includes systems that were procured or developed by the respective entity. In 
addition, we stated that a system with facial recognition technology may include a facial 
recognition algorithm, hardware, software, and a photo database. 


SWhen pretesting our questionnaire, some agencies indicated that they could not 
guarantee the accuracy of the answers to this question because they did not track the use 
of systems owned by other entities. In some instances, employees and contractors had to 
work from their memory on the usage of another entity’s systems. To help mitigate this 
issue, we gathered this information from April 2018 (a 2-year period) instead of January 
2015 (a 5-year period). For the purposes of this report, by saying an agency “used” 
another entity’s system, we mean that an agency’s offices, employees, and contractors (1) 
accessed a system owned or operated by another entity, or (2) requested that another 
entity use its system to conduct a facial recognition search on their behalf. 


Page 3 GAO-21-518 Facial Recognition Technology 


(Principles 7, 10, and 16).? See appendix | for additional information on 
our scope and methodology. 


The performance audit upon which this report is based was conducted 
from August 2019 to April 2021 in accordance with generally accepted 
government auditing standards. Those standards require that we plan 
and perform the audit to obtain sufficient, appropriate evidence to provide 
a reasonable basis for our findings and conclusions based on our audit 
objectives. We believe that the evidence obtained provides a reasonable 
basis for our findings and conclusions based on our audit objectives. We 
subsequently worked with the relevant entities from April 2021 to June 
2021 to prepare this version of the original sensitive report for public 
release. This public version was also prepared in accordance with these 
standards. 





Background 


How Facial Recognition 
Technology Works 


Biometric technologies can identify individuals by measuring and 
analyzing biological and behavioral characteristics such as a fingerprint, 
face, iris, heartbeat, voice, and gait (i.e., a person’s manner of walking). 
Facial recognition is one type of biometric technology. Facial recognition 
technology uses a photo or still from a video feed of a person—often 
called a probe or live photo—and converts it into a template, or a 
mathematical representation of the photo. A matching algorithm can then 
compare the template to one from another photo and calculate their 
similarity.® 


Facial recognition searches generally fall into two categories: verification 
and identification. Verification (or one-to-one searches) compares a photo 
to another photo of the same individual. For example, this type of search 
can help verify the identity of an individual attempting to unlock a 
smartphone. Identification (or one-to-many searches) compares a photo 
from a single individual against a gallery of photos from a number of 





7GAO, Enterprise Risk Management: Selected Agencies’ Experiences Illustrate Good 
Practices in Managing Risk, GAO-17-63 (Washington, D.C.: Dec. 1, 2016). Also see: 
GAO, Standards for Internal Control in the Federal Government, GAO-14-704G 
(Washington, D.C.: September 2014). Principle 7 states that management should identify, 
analyze, and respond to risks related to achieving the defined objectives. Principle 10 
states that management should design control activities to achieve objectives and respond 
to risks. Principle 16 states that management should establish and operate monitoring 
activities to monitor the internal control system and evaluate the results. 


8An algorithm is a set of rules that a computer or program follows to compute an outcome. 
Private companies have developed facial recognition algorithms for a variety of uses. 
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individuals to determine if there is a potential match. Importantly, 
identification searches can be used to generate investigative leads (i.e., 
potential matches) for criminal investigations. Figure 1 shows the process 
of a facial recognition search, including verification and identification 
searches. 
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Figure 1: Facial Recognition Technology Search Process 
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Acamera captures an image or video. The system detects that a face is The system creates a template by 

The image or still from the video feed is present by looking for the general shape aligning the image and adjusting for 
called the probe image. The image can of a human face. different poses or lighting, then extracting 
be live, previously recorded, or obtained features distinctive to the face. 


from a third party. 





























Step 4: 
Facial template matching 
Law enforcement can use the facial template for 
verification or identification purposes. 
Verification: Identification: 
Person A E A Person B Person C 
Facial image template Stored template or image gallery Facial image template Stored template or image gallery 

Verification, also called one-to-one matching, compares the facial template Identification, also called one-to-many matching, compares the facial 
from the probe image to the template of an existing image of the person to template from the probe image to a gallery of templates from stored images of 
verify their identity, such as when travelers’ live facial images are compared known people. The search seeks to identify a match or potential matches, 
against images taken from their identity document at an airport checkpoint. such as investigative leads for an unknown individual in a crime scene photo. 


Source: GAO analysis. | GAO-21-518 
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Federal and Non-Federal 
Systems with Facial 
Recognition Technology 


Privacy Laws and Rules 


Accuracy of Facial 
Recognition Technology 


Federal law enforcement can use systems with facial recognition 
technology owned by their respective agencies. They can also use 
systems owned by other government entities, including federal, state, 
local, tribal, and territorial governments. Moreover, federal law 
enforcement can use non-government facial recognition service 
providers, such as Vigilant Solutions and Clearview Al. For example, law 
enforcement officers with a Clearview Al account can use a computer or 
smartphone to upload a photo of an unknown individual to Clearview Al’s 
facial recognition system. The system can return search results that show 
potential photos of the unknown individual, as well as links to the site 
where the photos were obtained (e.g., Facebook). According to Clearview 
Al, its system is only used to investigate crimes that have already 
occurred and not for real-time surveillance. In addition, Clearview Al 
noted that its system uses images publicly available on the internet, and 
search results should only be used by law enforcement as investigative 
leads. 


Law enforcement officers may also have access to another entity’s 
system—that is, the officer can log into the system and conduct a facial 
recognition search. Alternatively, a law enforcement officer can request 
that another entity use its system to conduct facial recognition searches 
on their behalf. For example, a federal law enforcement officer may ask a 
state entity to conduct facial recognition searches on their behalf. 


Several statutory requirements govern the protection of personal 
information by federal agencies, including federal law enforcement’s use 
of facial images. For example, the Privacy Act of 1974 places limitations 
on agencies’ collection, disclosure, and use of personal information 
maintained in systems of records (e.g. photos). According to Office of 
Management and Budget (OMB) officials, the Privacy Act and OMB 
Circular A-130 generally provide that agencies must ensure that privacy 
requirements apply to systems operated by contractors or other entities 
on behalf of the Federal Government, which could include facial 
recognition service providers. 


The accuracy of facial recognition technology can be characterized in a 
number of ways. For example, a false positive rate is how often the 
technology incorrectly declares two images to be a match when they are 
actually from two different people. In addition, a false negative rate is how 
often the technology fails to declare two images to be a match when they 
are actually from the same person. Matching errors can be caused not 
only by the quality of the facial recognition technology, but also by the 
quality of the photos used in the matching process and other factors. The 
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National Institute of Standards and Technology has conducted research 
into the accuracy of facial recognition algorithms. It has evaluated 
hundreds of commercial facial matching algorithms for accuracy and 
speed since 2000. 





Twenty Federal 
Agencies Reported 
Owning or Using 
Systems with Facial 
Recognition 
Technology 


Of the 42 agencies we surveyed, 20 reported that they owned a system 
with facial recognition technology or used another entity’s system. As 
shown in figure 2, three agencies only owned a system, 12 agencies only 
used another entity’s system, and five agencies both owned a system and 
used another entity’s system. These 20 federal agencies collectively 
employ roughly 120,000 federal law enforcement officers. 1° According to 
agencies that owned or used systems, these systems can include 
hundreds of millions or billions of photos of various types. 


9We asked agencies whether at any point from January 2015 through March 2020, they 
owned a system with facial recognition technology, including systems in the process of 
being developed. In addition, we asked agencies whether at any point from April 2018 
through March 2020, they used facial recognition technology—that is, their offices, 
employees, or contractors (1) accessed a system owned/operated by another entity, or (2) 
requested that another entity use its system to conduct a facial recognition search on their 
behalf. See the complete list of agencies that received our questionnaire in appendix |. 


10These agencies employed roughly 120,000 federal law enforcement officers as of 
September 30, 2016, based on Bureau of Justice Statistics, Federal Law Enforcement 
Officers, 2016 — Statistical Tables, NCJ 251922 (Washington, D.C.: October 2019). 
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Figure 2: Ownership and Use of Facial Recognition Technology Reported by Federal Agencies that Employ Law Enforcement 
Officers 
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Source: GAO analysis of survey data. | GAO-21-518 
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Note: We sent a survey questionnaire to 42 federal agencies that employ law enforcement officers. 
We asked agencies whether at any point during January 2015 through March 2020, they owned a 
system with facial recognition technology, including systems in the process of being developed. In 
addition, we asked agencies whether at any point from April 2018 through March 2020, they used 
facial recognition technology—that is, their offices, employees, or contractors (1) accessed a system 
owned or operated by another entity, or (2) requested that another entity use its system to conduct a 
facial recognition search on their behalf. 


The owned system columns include systems in the process of being developed. The National 
Aeronautics and Space Administration’s Office of Protective Services reported that it did not purchase 
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Eight Agencies Reported 
Owning Systems with 
Facial Recognition 
Technology 


Detailed System Descriptions, Including 
Systems Listed in Table 1, Can be Found 
in Appendix Il and III of This Report 


An example of a system description is 
illustrated below. These descriptions include 
how agencies use the systems with facial 
recognition technology, whether the systems 
have a photo database, system users, and 


system statuses, among other information. 











‘SYSTEM CHARACTERISTICS 


























Source: GAO. | GAO-21-518 


facial recognition technology. However, we included the agency in the owned column because they 
used a commercial-off-the-shelf product with facial recognition technology to conduct a proof of 
concept test to determine whether the technology was suitable for its purposes. 


Eight of the 42 federal agencies reported owning 17 systems with facial 
recognition technology from January 2015 through March 2020.11 In 
addition, one of the eight agencies reported that it was in the process of 
procuring two systems during this time period, but had not finalized the 
purchase as of March 2020.12 


Table 1 below lists these 19 systems (17 owned and two in procurement) 
and their statuses as of March 31, 2020. Four of the 19 systems were in 
operation as of March 31, 2020, and were owned by three agencies: the 
FBI, Federal Bureau of Prisons, and CBP. Detailed descriptions of the 19 
systems can be found in appendix II. 





11This report omits some information about systems owned by agencies we surveyed, as 
the relevant agencies deemed the information sensitive. 


12The Department of Veterans Affairs Police Service was in the process of procuring the 
AnyVision and Motorola Avigilon Appearance Search systems as of March 31, 2020. The 
agency also owned the Aventura and Veritone aiWARE systems during the period of our 
review. 
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Table 1: Systems with Facial Recognition Technology that Federal Agencies Employing Law Enforcement Officers Reported 
as Owned or in Procurement, January 2015 through March 2020, and System Status 





System Status as 
























































Department Federal Agency System Name of March 31, 2020? 
Justice Federal Bureau of Next Generation Identification Interstate Photo e 
Investigation System 
Horus O 
Rank One O 
Automatic Face Detection and Recognition/Cluster 
Base @ 
Camera with Facial Recognition Software ® 
NeoFace Reveal ® 
Federal Bureau of Prisons Facial Recognition Access Control System e 
Homeland Security U.S. Customs and Border Automated Targeting System e 
Protection Traveler Verification Service e 
Transportation Security Automated Credential Authentication Technology O 
Administration Credential Authentication Technology-2 O 
U.S. Secret Service Facial Recognition Pilot ® 
Veterans Affairs Police Service AnyVision O 
Motorola Avigilon Appearance Search O 
Aventura ® 
Veritone aiWARE ® 
Defense Pentagon Force Protection Briefcam? ® 
Betiey Sirchie ® 
National Aeronautics and Office of Protective Services FaceFirst @ 


Space Administration 





Legend: @ In operation; O In development (e.g., being tested) or procurement; ® Not in use 


Source: GAO analysis of survey data. | GAO-21-518 


Note: We sent a survey questionnaire to 42 federal agencies that employ law enforcement officers. 
We asked agencies whether, at any point from January 2015 through March 2020, they owned or 
were in the process of procuring a system with facial recognition technology, including systems in the 
process of being developed. This table omits some information about systems owned by agencies we 
surveyed, as the relevant agency deemed the information sensitive. 


*The system status category “Not in use” refers to systems that agencies owned from January 1, 
2015 through March 31, 2020; however, the system was not in use as of March 31, 2020. For 
example, agencies reported that they no longer used a system, or tested a system and determined it 
was not suitable for their purposes. 


>The Briefcam system was in operation as of March 31, 2020; however, according to Pentagon Force 
Protection Agency officials, the facial recognition technology component of this system was not in 
operation. As such, the status of this system is marked “Not in use.” 
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Seventeen Federal 
Agencies Reported Using 
Systems Owned by Other 
Entities 


Seventeen of the 42 federal agencies reported using another entity’s 
system with facial recognition technology from April 2018 through March 
2020. Of the 17 agencies, 15 reported using systems owned by another 
federal entity; 14 reported using systems owned by state, local, tribal, or 
territorial entities; and 11 reported using systems owned by non- 
government entities. Furthermore, nine of the 17 agencies reported using 
systems owned by all three types of entities. See table 2 for additional 
information. 


Table 2: Reported Use of Other Entities’ Facial Recognition Technology by Federal Agencies that Employ Law Enforcement 


Officers 





Type of Entity That Owned System 





Non-Government? 





















































Other State, Local, Vigilant Other Non- 
Federal Agency That Used System Federal ‘Tribal, Territorial Clearview Al Solutions Government? 
Bureau of Diplomatic Security v v v v v 
U.S. Customs and Border Protection v v v v v 
U.S. Marshals Service v v v v v 
en Tobacco, Firearms and V V V V , 
U.S. Immigration and Customs Enforcement v v v — v 
U.S. Postal Inspection Service v v v v — 
Drug Enforcement Administration v v v — —_ 
Federal Bureau of Investigation v v v — —_ 
U.S. Secret Service v v v —_ —_ 
U.S. Capitol Police v v — — —_ 
U.S. Fish and Wildlife Service v v — _— —_— 
Food and Drug Administration, Office of Criminal V V -_ _ > 
Investigations 
Internal Revenue Service, Criminal Investigation V y, _ _ = 
Division 
U.S. Park Police — v —_— — 
Administrative Office of the U.S. Courts, U.S. -_ — - _ V 
Probation and Pretrial Services 
Pentagon Force Protection Agency v — —_— — — 
Transportation Security Administration v — — — — 
Total 15 14 10 5 5 





Legend: 
v Agency used a system owned by the respective 


entity (or entity type) at any point from April 2018 through March 2020. For federal, state, local, tribal, 


and territorial entities, the term “used” includes an agency’s offices, employees, or contractors (1) accessing a system owned/operated by the respective 
entity type, or (2) requesting that the respective entity type use its system to conduct a facial recognition search on the agency’s behalf. For non- 
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government entities, the term “used” means the agency’s offices, employees, or contractors submitted photos to the respective non-government service 
provider for the purpose of conducting a facial recognition search. 


— Agency did not use a system owned by the respective entity (or entity type) at any point from April 2018 through March 2020. 


Source: GAO analysis of survey data. | GAO-21-518 


Some agencies reported that they only used Clearview Al or Vigilant Solutions on a free trial basis, 
and thus, did not enter into a formal contract with the service provider. 


>Other non-government entities that agencies reported using included Amazon Rekognition, BI 
SmartLink, and Giant Oak Social Technology, among others. 


As discussed above, 15 agencies reported using a system owned by 
another federal entity. Ten of these agencies reported using systems 
owned by other federal agencies we surveyed. For example, the 
Transportation Security Administration reported using the U.S. Customs 
and Border Protection’s Traveler Verification Service. Agencies also 
reported using systems that were owned by federal entities that we did 
not survey. Specifically, based on survey responses, multiple agencies 
reported using the three systems listed in the table below. More 
information on each of these systems can be found in appendix III. 


Table 3: Select Systems with Facial Recognition Technology Owned by Federal Agencies 





System Name 


Federal Agency That Owns System 





Automated Biometric Identification System (ABIS) Defense Forensic Science Center (Department of Defense) 





Automated Biometric Identification System (IDENT) Office of Biometric and Identity Management (Department of 


Homeland Security) 





Integrated Biometric System 


Bureau of Consular Affairs (Department of State) 





Source: GAO analysis of survey data. | GAO-21-518 
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Examples of Federal Agencies Partnering 
with State and Local Entities 


Food and Drug Administration’s (FDA) 
Office of Criminal Investigations reported 
using the Georgia Department of Driver 
Services’ facial recognition technology. 
FDA reported using the technology to 
verify the identity of an individual under 
investigation who had assumed a stolen 
identity. 


U.S. Immigration and Customs 
Enforcement (ICE) reported helping to 
fund the development of a system with 
facial recognition technology that Lehigh 
County Regional Investigation and 
Intelligence Center (the Center) will own. 
Specifically, ICE and the Center are 
developing the National Capital Region 
Gang Intelligence Application to combat 
transnational gangs, according to ICE 
officials. Officials told us that once 
developed, ICE can use the system’s 
facial recognition technology to compare 
images of unknown individuals to a 
gallery of known and suspected gang 
members. 


U.S. Park Police reported that it asked a 
state agency to use facial recognition 
technology to help identify a deceased 
individual in a park. The state agency 
used a free trial with a non-government 
service provider to conduct the search, 
according to U.S. Park Police. 











Source: GAO analysis of survey data, 
zfmbek/stock.adobe.com. | GAO-21-518 


Fourteen federal agencies reported using systems owned by state, local, 
tribal, and territorial entities. For example, FBI's Facial Analysis, 
Comparison, and Evaluation Services had memorandums of 
understanding with certain state agencies, allowing it to leverage the 
state-owned systems for facial recognition searches. '3 According to the 
FBI, these state-owned systems include driver’s license photos, 
mugshots, or corrections photos. 


Eleven agencies we surveyed used systems with facial recognition 
technology belonging to non-government entities, including Clearview Al 
(10 agencies) and Vigilant Solutions (five agencies). 14 Ten agencies 
reported having used non-government facial recognition service providers 
on a free trial basis. For example, according to the U.S. Postal Inspection 
Service, it had a free trial with Vigilant Solutions that lasted approximately 
10 months in 2017. 





13The FBI’s Facial Analysis, Comparison, and Evaluation Services is located in the 
Investigative Services Support Unit of the Criminal Justice Information Services Division. It 
conducts facial recognition searches on the FBI’s Next Generation Identification Interstate 
Photo System and can request external partners perform searches on their facial 
recognition systems to support FBI active investigations. 


14|nformation regarding the extent that agencies used Clearview Al and Vigilant Solutions 
has been omitted from this report, as some agencies deemed the information sensitive. 
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Agencies Reported Using 
Systems that Varied in the 
Number and Type of 
Photos 


Types of Photos Used by Federal Agencies 
that Employ Law Enforcement Officers 


Federal agencies reported using a number of 
systems with facial recognition technology. 
The following list includes examples of the 
types of photos included in these systems, as 
reported by system owners and users: 


e Mug shot 

e Publicly available on the internet 
e Passport 

e Visa application 

e U.S. entry/exit 

e Video/Closed Circuit Television 
e Terrorist Screening Database 


e Foreign nationals and U.S. citizens who 
are known or suspected threats to the 
nation 


e Employee 

e State identification 

e Driver's license 

e Corrections 

e Individuals under supervision 











Source: GAO analysis of survey data, lidiia/stock.adobe.com. 
| GAO-21-518 


Federal agencies reported using numerous systems with facial 
recognition technology, and sometimes these systems included stored 
photos. The number and types of photos within these systems can vary, 
based on information reported by agencies and system owners. For 
example, as of March 31, 2020, the Bureau of Prisons’ Facial Recognition 
Access Control System included roughly 8,000 photos of its employees 
and contractors. Other systems include millions or billions of photos. For 
example, the Office of Biometric and Identity Management reported that 
its Automated Biometric Identification System (IDENT) included roughly 
836 million facial images as of March 31, 2020. According to agency 
officials, the types of photos include visa application, passport, mug shot, 
and others. Clearview Al told us its system includes roughly 3 billion 
publicly available photos gathered from the internet. 


Figure 3 below shows examples of federal, state, and non-government 
systems with facial recognition technology that federal agencies reported 
using, and the number of photos in them. Appendix II includes additional 
information on photos, including the number and type of photos in 
systems owned by federal agencies we surveyed. 
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Figure 3: Selected Federal, State, and Non-government Systems with Facial Recognition Technology Used by Federal 
Agencies that Employ Law Enforcement Officers, and the Number of Photos in Them 


U.S. Customs and Border 
Protection (Automated 
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Source: GAO analysis of information provided by system users or owners. | GAO-21-518 


Note: We sent a survey questionnaire to 42 federal agencies that employ law enforcement officers. 
This figure includes examples of systems used by one or more federal agencies we surveyed. It does 
not include all systems used by these agencies. The figure includes the number of photos stored in 
the respective entity’s system with facial recognition technology, as of March 31, 2020. 


The same individual may be included in multiple photos within one photo database or across multiple 
databases, and the same photo can exist within multiple databases. Some entities providing these 
numbers indicated they were estimates. The number of photos for federal and non-government 
entities were reported by the respective system owner. The number of photos for state entities were 
all reported by the Federal Bureau of Investigation (FBI). Specifically, the FBI's Facial Analysis, 
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Comparison, and Evaluation Services has memorandums of understanding with several state 
agencies, allowing it to leverage the state-owned systems for facial recognition searches. The FBI 
provided the number of photos they can access via these memorandums of understanding. 


fT —— —=E— ee 
: Most federal agencies that owned or used facial recognition technology 
Federal Agencies reported using it to support criminal investigations. Agencies also 
Reported Using reported using facial recognition technology for activities such as 
Systems with Facial surveillance, traveler verification, and research and education. 


Recognition Of the 20 federal agencies that owned or used facial recognition 

technology, 14 reported using the technology to support criminal 
Technology to investigations. For example, the FBI’s Next Generation Identification 
Support Various Interstate Photo System allows users to search a database of over 40 
Activities million photos. The system returns a list of potential candidates that law 

enforcement can use to generate investigative leads. According to the 
FBI, the system has been used for investigations of violent crimes, credit 
card and identity fraud, missing persons, and bank robberies, among 
others. The Department of Homeland Security’s Office of Biometric 
Identity Management offers a similar service to its partners (e.g., U.S. 
Immigration and Customs Enforcement). Specifically, the agency’s 
Automated Biometric Identification System can be used to search a photo 
of an unknown individual and provide potential matches (i.e., generate 
leads) to support criminal investigations. Federal agencies also reported 
using state, local, and non-government systems to support criminal 
investigations. 


Six agencies reported using facial recognition technology during May 
through August 2020 to support criminal investigations related to civil 
unrest, riots, or protests. 15 Following the death of George Floyd while in 
the custody of the Minneapolis, Minnesota police department on May 25, 
2020, nationwide civil unrest, riots, and protests occurred. ‘6 Six agencies 
told us that they used images from these events to conduct facial 
recognition searches during May through August 2020 in order to assist 
with criminal investigations (see table 4). All six agencies reported that 


15We requested this information from 17 agencies that indicated in their questionnaire 
response as (1) having a system with facial recognition technology that was in operation, 
or (2) using another entity’s system. See more information on our methodology in 
appendix I. 


161n September 2020, we reported that federal agencies deployed 16 tactical teams in 
relation to the civil unrest and protests. See: GAO, Federal Tactical Teams: 
Characteristics, Training, Deployments, and Inventory, GAO-20-710 (Washington, D.C.: 
September 2020). 


Page 17 GAO-21-518 Facial Recognition Technology 


these searches were on images of individuals suspected of violating the 
law. 


Se a I a i a eh a NI 
Table 4: Federal Agency Reported Use of Facial Recognition Technology on Images of Individuals Suspected of Violating the 
Law during Civil Unrest, Riots, or Protests, May through August 2020 





Federal Agency 


How Agency Reported Using Facial Recognition Technology 





Bureau of Alcohol, Tobacco, Firearms 
and Explosives 


In a single instance, used facial recognition technology owned by another law enforcement 
entity. The search was conducted to help identify an individual suspected of violating the law 
during the period of civil unrest, riots, or protests. 





U.S. Capitol Police 


Requested that the Montgomery County Department of Police (Montgomery County, 
Maryland) conduct facial recognition searches to assist with a criminal investigation. The 
purpose of the searches was to help identify individuals that confronted and made threats to 
a member of Congress and the member’s spouse outside the White House during the 
period of civil unrest, riots, or protests. 





Federal Bureau of Investigation 


Created a digital media tip line and solicited images of people involved in criminal activity 
during the period of civil unrest, riots, or protests. The agency sought to identify or locate 
criminal suspects seen in images and video depicting criminal behavior by conducting facial 
recognition searches using its Next Generation Identification Interstate Photo System. 





U.S. Marshals Service 


Used a non-government facial recognition service provider, to conduct facial recognition 
searches related to criminal investigations on images from the period of civil unrest, riots, or 
protests. 





U.S. Park Police 


Requested that the Maryland National Capital Park Police conduct a facial recognition 
search using an image from Twitter to identify an individual who allegedly assaulted an 
officer during the period of civil unrest, riots, or protests. The search was conducted on the 
National Capital Region Facial Recognition Investigative Leads System. The subject was 
ultimately charged with Felony Civil Disorder and two counts of Assault on a Police Officer. 





U.S. Postal Inspection Service 


Used Clearview AI to help identify individuals suspected of criminal activity that took place in 
conjunction with the period of civil unrest, riots, or protests. This criminal activity included 
damaging U.S. Postal Service property, stealing mail, opening mail, burglarizing U.S. Postal 
Service buildings, and committing arson. 





Source: GAO analysis of survey data. | GAO-21-518 


In addition, with regard to the January 6, 2021 events at the U.S. Capitol 
complex, three agencies reported using facial recognition technology to 
support criminal investigations related to the civil unrest, riots, or 
protests.'” The three agencies reported using the technology to support 
criminal investigations as follows: 


17We requested this information from 17 agencies that indicated in their questionnaire 
response as (1) having a system with facial recognition technology that was in operation, 
or (2) using another entity’s system. See more information on our methodology in 
appendix I. Twelve agencies reported that they did not use the technology for these 
purposes, three agencies reported using the technology, and two agencies told us they 
could not answer our questions because the information pertains to ongoing 
investigations. 
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e U.S. Capitol Police used Clearview Al to help generate investigative 
leads. The agency also requested that another federal agency use its 
system to conduct facial recognition searches on behalf of the U.S. 
Capitol Police. 


e CBP used its Automated Targeting System to conduct searches at the 
request of another federal agency. 


e Bureau of Diplomatic Security used the Department of State’s 
Integrated Biometric System to conduct searches at the request of 
another federal agency. 


Agencies also reported using facial recognition technology beyond 
criminal investigations. The following list includes examples of use cases, 
as reported by agencies. Appendix II includes more information on these 
use cases and others. 


e Surveillance. The U.S. Secret Service (Secret Service) piloted a 
system with facial recognition technology to determine whether it 
could be incorporated into the agency’s White House Complex 
security operations. Specifically, the Secret Service stored photos of 
23 volunteer employees within the system. As volunteers moved 
throughout the White House Complex, their images were captured by 
closed-circuit television cameras. In real time, the system compared 
the stored photos to images from the video footage to determine 
whether they represented the same individual. Secret Service told us 
it did not plan to implement the system based on the results of the 
pilot. 


e Response to Coronavirus Disease 2019 (COVID-19). In response 
to COVID-19, the Administrative Office of the U.S. Courts, Probation 
and Pretrial Services office began using facial recognition technology. 
The technology allowed individuals under court-ordered supervision to 
verify their identity via a smart phone application rather than physical 
contact with a probation or pretrial officer. According to agency 
officials, the program is limited to voluntary use by individuals under 
supervision in connection with court-ordered location or alcohol 
monitoring. 


e Traveler verification. CBP’s Traveler Verification Service uses facial 
recognition technology to verify the identity of travelers entering and 
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Most Agencies Do 
Not Track Non- 
Federal Systems in 
Use or Related Risks 


exiting the United States.18 CBP is testing and deploying the Traveler 
Verification Service in phases throughout the air, sea, and land travel 
environments at ports of entry. The system uses real-time capability to 
compare a traveler’s live photo to photos stored in Department of 
Homeland Security databases, such as passport photos, or to a photo 
embedded in a travel identification document. 


e Area access. The Federal Bureau of Prisons (BOP) uses its Facial 
Recognition Access Control System to authenticate entry into secure 
network operations centers at certain BOP facilities. The system 
verifies BOP employees’ identities using facial recognition technology, 
and once confirmed, employees can enter the operations centers. 


e Research and education. The FBI is using systems for research and 
education purposes. For example, it is examining how well systems 
perform when used on its casework. In addition, the bureau is trying to 
determine whether these systems could be incorporated into its one- 
to-one comparisons process. Currently, FBI forensic examiners 
manually compare two images to validate whether faces within the 
images represent the same individual (i.e., one-to-one comparisons). 
The FBI is researching whether it would be beneficial to use a facial 
recognition system in addition to forensic examiners. It is also using 
systems in educational settings to demonstrate how facial recognition 
technology works. 


Thirteen federal agencies do not have awareness of what non-federal 
systems with facial recognition technology are used by employees. '9 
These agencies have therefore not fully assessed the potential risks of 
using these systems, such as risks related to privacy and accuracy. Most 
federal agencies that reported using non-federal systems did not own 
systems. Thus, employees were relying on systems owned by other 
entities, including non-federal entities, to support their operations. 


18While regulations limit CBP’s collection of biometric information to certain foreign 
nationals entering and exiting the United States, CBP’s biometric entry-exit capabilities 
may also capture biometric data (facial images) from exempt foreign nationals and U.S. 
citizens. However, exempt foreign nationals and U.S. citizens are routinely able to “opt 
out” of using this technology to verify their identity and can instead choose a manual 
check of documentation for identity verification. For more information, see GAO-20-568. 


19Throughout this section, when we say that an agency did not have awareness of what 
systems are used by employees, we are referring to both the agency’s employees and 
contractors. By non-federal systems, we are referring to systems owned by state, local, 
tribal, territorial, and non-government entities. 


Page 20 GAO-21-518 Facial Recognition Technology 


Tracking Use of Non- 
Federal Systems 


We found that 13 of 14 agencies that reported using non-federal systems 
do not have complete, up-to-date information on what non-federal 
systems are used by employees.2° For example, when we requested 
information from one of the agencies about its use of non-federal 
systems, agency officials told us they had to poll field division personnel 
because the information was not maintained by the agency. These 
agency officials also told us that the field division personnel had to work 
from their memory about their past use of non-federal systems, and that 
they could not ensure we were provided comprehensive information 
about the agency’s use of non-federal systems. Officials from another 
agency initially told us that its employees did not use non-federal 
systems; however, after conducting a poll, the agency learned that its 
employees had used a non-federal system to conduct more than 1,000 
facial recognition searches. 


One agency—the U.S. Immigration and Customs Enforcement—reported 
that it was in the process of implementing a mechanism to track what 
non-federal systems are used by employees.2' According to U.S. 
Immigration and Customs Enforcement officials, in November 2020 they 
were in the process of developing a list of approved facial recognition 
technologies that employees can use. In addition, log-in sheets will be 
made available to employees, allowing supervisors to monitor employee 
use of the technologies. The agency will allow the use of non-reviewed 
systems under exigent circumstances; however, supervisor approval is 
required. The use of systems that have been reviewed and not approved 
for use is strictly prohibited, even in exigent circumstances, according to 
U.S. Immigration and Customs Enforcement. 


However, the other 13 agencies do not have complete, up-to-date 
information because they do not regularly track this information and have 
no mechanism in place to do so (see table 5).22 For example, the Criminal 





20By complete, up-to-date information, we mean that an agency has ongoing knowledge 
of what non-federal systems with facial recognition technology are used by employees. 
Fifteen agencies reported using non-federal systems; however, we excluded U.S. 
Probation and Pretrial Services because it does not use facial recognition technology to 
support criminal investigations. All 14 agencies discussed in this section reported using 
the technology to support criminal investigations. 


21According to U.S. Immigration and Customs Enforcement officials, only employees 
within its Homeland Security Investigations will be subject to the procedures, as only 
employees within this component of the agency use facial recognition technology. 


22We asked agencies whether they had a mechanism to track what systems were used by 
employees, not whether agencies track each individual use of a system by employees. 
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Investigation Division within the Internal Revenue Service told us it does 
not track what non-federal systems are used by employees because it is 
not the owner of these technologies. Similarly, the U.S. Postal Inspection 
Service said it did not track what systems employees use because it is 
the responsibility of the system owner to govern use of the system. 


nS eee 
Table 5: Federal Agency Tracking of Employee Use of Non-Federal Systems with 
Facial Recognition Technology 





Have Mechanism to 
Track What Non- 
Federal Systems Are 






































Federal Agency Used by Employees 
U.S. Immigration and Customs Enforcement Yes 
Bureau of Alcohol, Tobacco, Firearms and Explosives No 
Bureau of Diplomatic Security No 
U.S. Capitol Police No 
U.S. Customs and Border Protection No 
Drug Enforcement Administration No 
Federal Bureau of Investigation No 
U.S. Fish and Wildlife Service No 
Food and Drug Administration, Office of Criminal No 
Investigations 

Internal Revenue Service, Criminal Investigation Division No 
U.S. Marshals Service No 
U.S. Park Police No 
U.S. Postal Inspection Service No 
U.S. Secret Service No 





Source: GAO analysis of agency information. | GAO-21-518 


Note: Federal agencies marked “No” may have known that employees used certain systems, but they 
do not have a mechanism to provide complete, up-to-date information of what systems are used by 
employees. 


Standards for Internal Control in the Federal Government state that 
agencies should design and implement controls to help achieve agencies’ 
objectives, which, in this case, is to conduct investigative activities. 23 
These standards also state that ongoing monitoring—such as regular 
oversight that would provide visibility into the non-federal systems used 
by employees—should be performed continually in the course of normal 
operations. 





23GAO-14-704G. 
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Assessing Risks Related 
to Non-Federal Systems 


Internal control standards further underscore that management should 
identify, analyze, and respond to risks related to achieving the defined 
objectives. Additionally, we have previously reported that enterprise risk 
management can help federal agencies assess risks, such as those 
related to the use of non-federal systems.24 For example, assembling a 
list of risks can help an agency identify threats that could limit its ability to 
achieve goals and objectives. 


By implementing a mechanism to track what non-federal systems with 
facial recognition technology are used by employees, agencies will be 
able to have visibility into the systems that employees are relying on to 
assist with investigative activities.26 Gathering this information on a 
continuous basis can serve as an important initial step to identifying risks 
associated with non-federal systems. When asked about the potential 
implementation of a mechanism to track what systems are used by 
employees, seven of the 13 agencies told us that it was feasible or did not 
express any specific concerns. The other six agencies did not comment. 


As 13 federal agencies do not have awareness of non-federal systems 
used by employees, they cannot fully assess the risks of using these 
systems. Numerous risks to federal agencies and the public can 
accompany the use of facial recognition technology. In particular, these 
risks can relate to privacy and the accuracy of a system. 


Several privacy-related requirements govern the protection of personal 
information by federal agencies, including federal law enforcement’s use 
of facial images. For example, the Privacy Act of 1974 places limitations 
on agencies’ collection, disclosure, and use of personal information 
maintained in systems of records (e.g. photos).26 Additionally, according 
to OMB officials, the E-Government Act of 2002 and OMB Privacy policy 


24GAO-17-63. 


25This sentence describes the potential benefits of tracking what systems are used by 
employees, and not each individual use of a system by employees. 


26See 5 U.S.C. § 552a(4). Per OMB guidance and the Federal Acquisition Regulation, 
agency obligations to maintain privacy protections and adhere to the Privacy Act of 1974 
obligations extend to information technology systems that are used or operated by 
contractors or other entities on behalf of the federal government or that collect or maintain 
federal information on behalf of the federal government. See Office of Management and 
Budget Memorandum (OMB) Circular A-130, Managing Information as a Strategic 
Resource (July 28, 2016); Federal Acquisition Regulation, Subpart 24.1 Protection of 
Individual Privacy. 
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requirements necessitate that when an agency procures information 
technology that processes personally identifiable information from outside 
services, such as a third-party vendor or state or local government, 
agencies must conduct an assessment of the privacy implications.2? 


When agencies use facial recognition technology without first assessing 
the privacy implications and applicability of privacy requirements, there is 
a risk that they will not adhere to privacy-related laws, regulations, and 
policies. There is also a risk that non-federal system owners will share 
sensitive information (e.g. photo of a suspect) about an ongoing 
investigation with the public or others. In addition, privacy advocacy 
organizations, government agencies, academics, and some industry 
representatives have raised privacy and security concerns. For example, 
there is a risk that data sets with personal information could be subject to 
breaches, resulting in sensitive biometric data being revealed to 
unauthorized entities. Because a person’s face is distinctive, permanent, 
and therefore irrevocable, a breach involving data derived from a face 
may have more serious consequences than the breach of other 
information, such as passwords, which can be changed. 


The U.S. Immigration and Customs Enforcement assessed privacy risks 
associated with its use of facial recognition technology, including non- 
federal systems.28 The assessment was reviewed by the Chief Privacy 
Officer for the Department of Homeland Security. In the assessment, the 
agency identified privacy risks and what, if any, actions it can take to 
mitigate these risks. For example, as part of its process, before using a 
non-federal systems the agency plans to ensure that: 


e methods of transmission of a probe photo are properly encrypted, 


e noprobe photos submitted by U.S. Immigration and Customs 
Enforcement are retained by the system owner or shared with other 
parties, and 


e appropriate safeguards for housing sensitive personally identifiable 
information exist. 


Accuracy rates can help agencies determine how often facial recognition 
technology correctly or incorrectly declares that two or more images 





27See Pub. L. No. 107-347, 116 Stat. 2899 (2002). 


28Department of Homeland Security, Privacy Impact Assessment for the ICE Use of Facial 
Recognition Services, DHS/ICE/PIA-054 (May 13, 2020). 
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match. Matching errors can be caused by the quality of the facial 
recognition technology, and other factors such as the quality of photos 
used in the matching process. Although the accuracy of facial recognition 
technology has increased dramatically in recent years, risks still exist that 
searches will provide inaccurate results. For example, if a system is not 
sufficiently accurate, it could unnecessarily identify innocent people as 
investigative leads. The system could also miss investigative leads that 
could otherwise have been revealed. In December 2019, the National 
Institute of Standards and Technology reported that facial recognition 
algorithms it tested differed in accuracy widely by race, ethnicity, or 
country of origin, as well as by gender and age.29 In addition, some 
members of Congress, privacy groups, and others have expressed 
concerns that facial recognition technology’s higher error rates for certain 
demographics could result in disparate treatment, profiling, or other 
adverse consequences for members of these populations. 


The U.S. Immigration and Customs Enforcement, as part of the risk 
assessment described earlier, also considered the accuracy of non- 
federal systems. According to the assessment, the agency will leverage 
resources such as the National Institute of Standards and Technology’s 
testing on the accuracy and bias of systems. Additionally, the agency said 
it will conduct non-scientific tests to gain insight into the veracity of a 
system. 


However, as the other 13 federal agencies do not have awareness of 
non-federal systems used by employees, they cannot fully assess the 
risks (€.g., privacy and accuracy-related risks) of using these systems. As 
described earlier, we have previously reported that assembling a list of 
risks can help an agency identify threats to achieving its goals and 
objectives. In addition, prioritizing identified risks and selecting the most 
appropriate treatment strategy to manage the risks are important next 
steps. 





29National Institute of Standards and Technology, Face Recognition Vendor Test (FRVT) 
Part 3: Demographic Effects, NIST Interagency or Internal Report 8280 (Dec. 19, 2019). 
The National Institute of Standards and Technology reported that it tested 189 mostly 
commercial algorithms from 99 developers and that performance differences varied by the 
algorithms tested, with some performing better than others. For a small number of the 
one-to-many algorithms, differences in false positives across demographic groups were 
undetectable. The extent of performance differences varied by the developer, type of 
error, and quality of the facial images. 


Page 25 GAO-21-518 Facial Recognition Technology 


Conclusions 


Recommendations for 
Executive Action 


Without assessing the risks of using non-federal systems, agencies are 
more susceptible to risks that negatively affect their ability to meet stated 
goals and objectives. For example, agencies cannot ensure appropriate 
privacy safeguards are in place to prevent the mishandling of personal 
information when using non-federal systems. In addition, agencies cannot 
ensure they are using systems sufficiently accurate for their purposes. °° 
Failure to appropriately assess risks when using non-federal systems with 
facial recognition technology could ultimately result in a reputational 
catastrophe, hindering an agency’s efforts to meet its core mission for 
years. 


Facial recognition technology is a powerful tool used by the federal law 
enforcement community. Federal agencies that employ law enforcement 
officers rely on systems with facial recognition technology, and the 
potentially millions or billions of photos stored in these systems, to help 
generate investigative leads and solve crimes. However, 13 federal 
agencies cannot assess the risks of using non-federal systems because 
they are unaware of what systems are used by employees. By 
implementing a mechanism to track what non-federal systems are used 
by employees, agencies will have better visibility into the technologies 
they rely upon to conduct criminal investigations. In addition, by 
assessing the risks of using these systems, including privacy and 
accuracy-related risks, agencies will be better positioned to mitigate any 
risks to themselves and the public. 


We are making the following 26 recommendations: 


The Director of the Bureau of Alcohol, Tobacco, Firearms and Explosives 
should implement a mechanism to track what non-federal systems with 
facial recognition technology are used by employees to support 
investigative activities. (Recommendation 1) 


The Director of the Bureau of Alcohol, Tobacco, Firearms and Explosives 
should, after implementing a mechanism to track non-federal systems, 
assess the risks of using such systems, including privacy and accuracy- 
related risks. (Recommendation 2) 


The Administrator for the Drug Enforcement Administration should 
implement a mechanism to track what non-federal systems with facial 





30This sentence describes the potential benefits of understanding and managing 
accuracy-related risks, which may or may not result in agencies testing the accuracy of 
individual systems used by employees. 


Page 26 GAO-21-518 Facial Recognition Technology 


recognition technology are used by employees to support investigative 
activities. (Recommendation 3) 


The Administrator for the Drug Enforcement Administration should, after 
implementing a mechanism to track non-federal systems, assess the risks 
of using such systems, including privacy and accuracy-related risks. 
(Recommendation 4) 


The Director of the FBI should implement a mechanism to track what non- 
federal systems with facial recognition technology are used by employees 
to support investigative activities. (Recommendation 5) 


The Director of the FBI should, after implementing a mechanism to track 
non-federal systems, assess the risks of using such systems, including 
privacy and accuracy-related risks. (Recommendation 6) 


The Director of the U.S. Marshals Service should implement a 
mechanism to track what non-federal systems with facial recognition 
technology are used by employees to support investigative activities. 
(Recommendation 7) 


The Director of the U.S. Marshals Service should, after implementing a 
mechanism to track non-federal systems, assess the risks of using such 
systems, including privacy and accuracy-related risks. (Recommendation 
8) 


The Commissioner of CBP should implement a mechanism to track what 
non-federal systems with facial recognition technology are used by 
employees to support investigative activities. (Recommendation 9) 


The Commissioner of CBP should, after implementing a mechanism to 
track non-federal systems, assess the risks of using such systems, 
including privacy and accuracy-related risks. (Recommendation 10) 


The Director of the Secret Service should implement a mechanism to 
track what non-federal systems with facial recognition technology are 
used by employees to support investigative activities. (Recommendation 
11) 


The Director of the Secret Service should, after implementing a 
mechanism to track non-federal systems, assess the risks of using such 
systems, including privacy and accuracy-related risks. (Recommendation 
12) 
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The Director of the U.S. Fish and Wildlife Service should implement a 
mechanism to track what non-federal systems with facial recognition 

technology are used by employees to support investigative activities. 
(Recommendation 13) 


The Director of the U.S. Fish and Wildlife Service should, after 
implementing a mechanism to track non-federal systems, assess the risks 
of using such systems, including privacy and accuracy-related risks. 
(Recommendation 14) 


The Chief of the U.S. Park Police should implement a mechanism to track 
what non-federal systems with facial recognition technology are used by 
employees to support investigative activities. (Recommendation 15) 


The Chief of the U.S. Park Police should, after implementing a 
mechanism to track non-federal systems, assess the risks of using such 
systems, including privacy and accuracy-related risks. (Recommendation 
16) 


The Assistant Secretary of the Bureau of Diplomatic Security should 
implement a mechanism to track what non-federal systems with facial 
recognition technology are used by employees to support investigative 
activities. (Recommendation 17) 


The Assistant Secretary of the Bureau of Diplomatic Security should, after 
implementing a mechanism to track non-federal systems, assess the risks 
of using such systems, including privacy and accuracy-related risks. 
(Recommendation 18) 


The Assistant Commissioner of the Food and Drug Administration’s Office 
of Criminal Investigations should implement a mechanism to track what 
non-federal systems with facial recognition technology are used by 
employees to support investigative activities. (Recommendation 19) 


The Assistant Commissioner of the Food and Drug Administration’s Office 
of Criminal Investigations should, after implementing a mechanism to 
track non-federal systems, assess the risks of using such systems, 
including privacy and accuracy-related risks. (Recommendation 20) 


The Chief of the Internal Revenue Service’s Criminal Investigation 
Division should implement a mechanism to track what non-federal 
systems with facial recognition technology are used by employees to 
support investigative activities. (Recommendation 21) 
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The Chief of the Internal Revenue Service’s Criminal Investigation 
Division should, after implementing a mechanism to track non-federal 
systems, assess the risks of using such systems, including privacy and 
accuracy-related risks. (Recommendation 22) 


The Chief Postal Inspector of the U.S. Postal Inspection Service should 
implement a mechanism to track what non-federal systems with facial 
recognition technology are used by employees to support investigative 
activities. (Recommendation 23) 


The Chief Postal Inspector of the U.S. Postal Inspection Service should, 
after implementing a mechanism to track non-federal systems, assess the 
risks of using such systems, including privacy and accuracy-related risks. 
(Recommendation 24) 


The Chief of Police, U.S. Capitol Police, should implement a mechanism 
to track what non-federal systems with facial recognition technology are 
used by employees to support investigative activities. (Recommendation 
25) 


The Chief of Police, U.S. Capitol Police, should, after implementing a 
mechanism to track non-federal systems, assess the risks of using such 
systems, including privacy and accuracy-related risks. (Recommendation 
26) 


We provided a draft of this product for comment to the 21 federal 

Agency Comments departments and other entities (i.e., entities) that responded to our 

and Our Evaluation survey.31 We made recommendations to eight of the 21 entities, and 
these eight entities generally concurred with our recommendations.*2 





31Although we surveyed 42 federal agencies, we generally provide draft products for 
comment to the respective department (e.g., Department of Homeland Security) rather 
than the individual agencies (e.g., U.S. Customs and Border Protection) within a 
department. See the list of 21 departments and other entities (e.g., Amtrak) that received 
the draft product at table 6 in appendix |. 


32We made recommendations to 13 of the 42 federal agencies that we surveyed. These 
13 agencies are located within eight federal departments and entities (i.e., entities), and 
as discussed, these eight entities generally concurred with our recommendations. 
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Seven of the eight entities provided written comments, which are 
reproduced in appendices IV through X and summarized below.33 


e U.S. Department of Health and Human Services concurred with our 
recommendations. 


e Department of Homeland Security concurred with our 
recommendations and provided technical comments, which we 
incorporated as appropriate. 


e Department of the Interior concurred with our recommendations. 


e Department of Justice’s Federal Bureau of Investigation concurred 
with our recommendations and provided technical comments, which 
we incorporated as appropriate. 


e Department of State concurred with our recommendations and 
provided technical comments, which we incorporated as appropriate. 


e Department of the Treasury concurred with our recommendations, 
stating that the Internal Revenue Service’s Criminal Investigation 
Division has mechanisms in place capable of tracking non-federal 
systems used by employees. However, during our review, the 
Criminal Investigation Division told us it does not track what systems 
are used by employees because it is not the owner of these 
technologies. Moreover, as noted in our report, the Criminal 
Investigation Division used facial recognition technology owned by 
other governmental entities at the federal and state, local, tribal, or 
territorial level. We therefore continue to believe that the Criminal 
Investigation Division should, as part of implementing these 
recommendations, ensure mechanisms are in place to appropriately 
track what non-federal systems (e.g., systems owned by other federal 
and state agencies) are used to support its investigative activities. 


e U.S. Postal Service concurred, in part, with our recommendation to 
develop a mechanism to track what non-federal systems employees 
use. Specifically, the agency told us that the U.S. Postal Inspection 
Service currently tracks employee use of certain non-federal systems. 
Thus, the agency said it only needs to develop a mechanism to track 
other non-federal systems that employees use. Our report 
acknowledges that agencies may have had awareness of certain non- 
federal systems used by employees. However, U.S. Postal Inspection 
Service does not have a mechanism to provide complete, up-to-date 





33As discussed earlier, this report is a public version of a sensitive report that we issued in 
April 2021. Five of the seven entities asked that we reprint their comments from the 
sensitive report, which are reproduced in appendices VI through X. 
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information about what non-federal systems are used by employees. 
As a result, we continue to believe our recommendation, as written, is 
valid. In addition, the U.S. Postal Service concurred with our 
recommendation to assess the risks associated with non-federal 
systems. 


Two of the eight entities that received recommendations emailed their 
comments. Specifically, the U.S. Capitol Police concurred with our 
recommendations and provided technical comments, which we 
incorporated as appropriate. In addition, the Department of Justice 
concurred with our recommendations and provided technical comments, 
which we incorporated as appropriate. Of note, the Department of Justice 
provided written and emailed comments. 


We did not make recommendations to 13 of the 21 entities. Two of the 13 
entities provided technical comments, which we incorporated as 
appropriate. Specifically, the Department of Commerce provided technical 
comments from the National Institute of Standards and Technology, and 
the National Aeronautics and Space Administration provided technical 
comments. The remaining 11 entities informed us that they had no 
comments. 


We also provided a draft of this product for comment to two entities that 
did not receive our survey—the Office of Management and Budget and 
Clearview Al. The Office of Management and Budget informed us they 
had no comments, and Clearview Al provided technical comments, which 
we incorporated as appropriate. 


As agreed with your offices, unless you publicly announce the contents of 
this report earlier, we plan no further distribution until 30 days from the 
report date. At that time, we will send copies to the relevant federal 
departments and entities.%4 In addition, the report is available at no 
charge on the GAO website at https://www.gao.gov. 


If you or your staff have any questions about this report, please contact 
me at (202) 512-8777 or goodwing@gao.gov. Contact points for our 
Offices of Congressional Relations and Public Affairs may be found on 





34Specifically, we will send copies to the 21 federal departments and other entities 
included in table 6 at appendix I. In addition, we will send a copy to the Office of 
Management and Budget. 
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the last page of this report. GAO staff who made key contributions to this 
report are listed in appendix XI. 


Gretta L. Goodwin 


Director 
Homeland Security and Justice 
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United States Senate 
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United States Senate 
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United States Senate 


The Honorable Ron Wyden 
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Appendix |: Objectives, Scope, and 
Methodology 


This report examines (1) what federal agencies that employ law 
enforcement officers own and use facial recognition technology, (2) the 
type of activities these federal agencies use facial recognition technology 
to support, and (3) the extent that these federal agencies track employee 
use of facial recognition technology owned by non-federal entities, 
including state, local, tribal, territorial, and non-government entities. 


This report is a public version of a sensitive report that we issued in April 
2021.1 Some federal agencies deemed information in our April report to 
be sensitive, which must be protected from public disclosure. Therefore, 
this report omits sensitive information about agency ownership and use of 
facial recognition technology. Although the information provided in this 
report is more limited, the report addresses the same objectives as the 
sensitive report and uses the same methodology. 


To address all three objectives, we surveyed 42 federal agencies that 
employ law enforcement officers. Consistent with our prior work, we 
define federal law enforcement officers as full-time employees with 
federal arrest authority and who are authorized to carry firearms while on 
duty. To identify which agencies employ federal law enforcement officers, 
we reviewed the Bureau of Justice Statistics’ 2016 Census of Federal 
Law Enforcement Officers.2 The 2016 census identified the number of law 
enforcement officers employed by federal entities, with the exception of 
officers in the U.S. Armed Forces, officers stationed in foreign countries, 
and officers at the Central Intelligence Agency or Transportation Security 
Administration’s Federal Air Marshal Service. 


Our scope included 42 of the 86 federal entities identified in the 2016 
census as employing law enforcement officers (see table 6). The 2016 
Census included Offices of Inspectors General; however, we excluded 
these agencies. We contacted the Council of the Inspectors General on 
Integrity and Efficiency, who stated that they were unaware of any Offices 
of Inspectors General that use facial recognition technology. However, we 
did include the Transportation Security Administration because it employs 
federal law enforcement officers, and was excluded from the 2016 census 
report for sensitivity reasons. 





1GAO, Facial Recognition Technology: Federal Law Enforcement Agencies Should Better 
Assess Privacy and Other Risks, GAO-21-243SU (Washington, D.C.: April 28, 2021). 


2Bureau of Justice Statistics, Federal Law Enforcement Officers, 2016 — Statistical Tables, 
NCJ 251922 (Washington, D.C.: October 2019). 
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SSE ry 
Table 6: 42 Federal Agencies Selected in GAO’s Work 































































































Federal Agency Department 
Forest Service Agriculture 

Bureau of Industry and Security Commerce 
National Oceanic and Atmospheric Administration, Office of Law Enforcement Commerce 

Office of Security Commerce 
Secretary’s Protective Detail Commerce 
Pentagon Force Protection Agency Defense 

National Nuclear Security Administration Energy 

Food and Drug Administration, Office of Criminal Investigations Health and Human Services 
National Institutes of Health, Division of Police Health and Human Services 
U.S. Customs and Border Protection Homeland Security 
Federal Emergency Management Agency, Mount Weather Police Homeland Security 
Federal Protective Service Homeland Security 
U.S. Immigration and Customs Enforcement Homeland Security 
Office of the Chief Security Officer Homeland Security 
U.S. Secret Service Homeland Security 
Transportation Security Administration Homeland Security 
Bureau of Indian Affairs, Office of Justice Services Interior 

Bureau of Land Management Interior 

Bureau of Reclamation Interior 

U.S. Fish and Wildlife Service Interior 

U.S. Park Police Interior 

National Park Service Rangers Interior 

Bureau of Alcohol, Tobacco, Firearms and Explosives Justice 

Drug Enforcement Administration Justice 

Federal Bureau of Investigation Justice 

Federal Bureau of Prisons Justice 

U.S. Marshals Service Justice 

Division of Protective Operations Labor 

Bureau of Diplomatic Security State 

Bureau of Engraving and Printing Police Treasury 

Internal Revenue Service, Criminal Investigation Division Treasury 

U.S. Mint Police Treasury 

Police Service Veterans Affairs 





Amtrak Police Department - 





Environmental Protection Agency, Criminal Investigation Division - 
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Federal Agency 


Department 





National Aeronautics and Space Administration, Office of Protective Services - 





U.S. Postal Inspection Service 





Smithsonian Institution, Office of Protection Services - 





Tennessee Valley Authority Police 





Administrative Office of the U.S. Courts, U.S. Probation and Pretrial Services - 





U.S. Capitol Police 





Government Publishing Office, Uniform Police Branch - 





Legend: — Not Applicable 
Source: GAO information. | GAO-21-518 


To answer our first and second objectives, we administered a survey 
questionnaire to each of these 42 federal agencies. We administered the 
questionnaire by email from April through November 2020. Because we 
surveyed and obtained responses from all 42 agencies in the population 
defined by our scope, the summary results describing this group are not 
subject to errors from sampling and nonresponse. However, the practical 
difficulties of conducting any questionnaire survey may introduce other 
errors. For example, difficulties in how a particular question is interpreted 
by respondents, in the sources of information that are available to 
respondents, or in how we processed and analyzed the responses we 
received can influence the accuracy of the survey results. We took steps 
in the development of the questionnaire, the data collection, and the data 
analysis to minimize these potential errors, and to help ensure the 
accuracy of the answers that were obtained. We conducted pre-tests with 
three agencies in different departments to test the survey’s applicability to 
a variety of facial recognition technology use cases, and revised the 
questionnaire based on the pre-tests. 


When agencies submitted survey responses, we conducted an initial 
review for completeness, discrepancies, or logical errors within the 
responses, or discrepancies based on our prior knowledge (e.g., based 
on our review of a privacy impact assessment). We asked agencies to re- 
submit or clarify responses if necessary. We also confirmed our 
understanding of agency-provided information in semi-structured, open- 
ended follow-up interviews and information requests to the 20 agencies 
that reported they owned or used facial recognition technology. To help 
corroborate the information agencies provided in the questionnaire, we 
conducted a search of government contracting information, agency 
websites, and privacy documentation. When we discovered 
discrepancies, we followed up with the agency as appropriate. 
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We sent the questionnaire to audit liaisons or their designees for 
dissemination to relevant subject matter experts. We instructed these 
liaisons to provide a response on behalf of their organization, which would 
include all the agency’s offices, employees, and contractors. The 
questionnaire defined facial recognition technology as a type of 
automated or semi-automated biometric technology that uses images for 
verification, identification, and/or investigative purposes. The 
questionnaire noted that facial recognition technology can be used for a 
variety of applications, such as verifying the identity claimed by an 
individual, identifying if an unknown individual exists in a gallery of known 
people, or comparing an unknown person to a gallery of known people to 
develop an investigative lead. In addition, we stated that a system with 
facial recognition technology may include a facial recognition algorithm, 
hardware, software, and a photo database. We asked agencies to include 
all uses of facial recognition technology in their response except for facial 
recognition technology that was solely used to authenticate the identity of 
the agency’s employees and contractors to log into computers and 
phones. 


The questionnaire asked whether at any point during January 2015 
through March 2020, an agency owned a system with facial recognition 
technology, including systems in the process of being developed.* We 
used this time frame because March 2020 was the most recent full month 
for which information was available when we issued our questionnaire. 
Also, using a 5-year period allowed us to identify technology that was 
recently developed but not put in operation, and identify trends in facial 
recognition search data. We also asked whether at any point from April 
2018 through March 2020, an agency’s offices, employees, or contractors 
(1) accessed a system owned or operated by another entity, or (2) 
requested that another entity use its system to conduct a facial 
recognition search on their behalf.4 All 42 agencies responded to 
questions about the use of another entity's systems; however, some 
indicated that they could not guarantee the accuracy of the answers 
because they did not track this information. In some instances, 
employees and contractors had to work from their memory on the usage 
of another entity’s systems. Agencies expressed this concern when we 





3In our questionnaire, we stated that the term “own” includes systems that were procured 
or developed by the respective entity. 


4For the purposes of this report, by saying an agency “used” another entity’s system, we 
mean that an agency’s offices, employees, and contractors (1) accessed a system owned 
or operated by another entity, or (2) requested that another entity use its system to 
conduct a facial recognition search on their behalf. 
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pretested the questionnaire, thus, we gathered this information from April 
2018 (a 2-year period) instead of January 2015 (a 5-year period). 


Agencies that owned a system completed an attachment with additional 
questions, such as the reason the agency used the system and the 
operational status of the system. In addition, we asked about the number 
of searches conducted on the system from 2015 through 2019, and 
number of photos included within the system as of March 31, 2020. We 
asked agency officials about the source of the data, whether the data 
were approximations or exact, whether definitions were consistently used 
in producing the data, and if there were any other data limitations that we 
should consider when reporting the information. 


We requested additional information, through interviews and written 
requests, from agencies that reported in their questionnaire that they 
owned or used facial recognition technology. For example, if an agency 
reported having a system in operation, we requested privacy impact 
assessments and system descriptions. The information was used to help 
develop the system description and status throughout the report, 
including the detailed system appendices. In addition, we requested that 
17 federal agencies provide information regarding whether they had used 
facial recognition technology on images of the civil unrest, riots, or 
protests from May through August 2020—the most recent full month for 
which information was available when we sent our questions. We also 
asked these 17 federal agencies whether they conducted facial 
recognition searches from January 6 through January 22, 2021 on 
images of the riot and civil unrest that occurred at the U.S. Capitol 
complex on January 6, 2021. We requested this information from 17 
agencies that reported, via our questionnaire described above, they (1) 
had a system with facial recognition technology that was in operation, or 
(2) had used another entities’ system. One exception was the Federal 
Bureau of Prisons, which we excluded because its system is used by 
employees to enter secure rooms. 


To answer our third objective, we reviewed statutes and regulations, such 
as the Privacy Act of 1974. In addition, we interviewed or requested 
information from officials from 14 agencies that reported using (1) non- 
federal systems, and (2) facial recognition technology to support criminal 
investigations. We determined that the control activities component of 
internal control was significant to this objective, along with the underlying 
principles that management should design control activities to achieve its 
objective and respond to risks. Specifically, we asked officials from the 14 
agencies about their processes for gathering information on what non- 
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federal systems are used by employees, and compared this information 
against our risk management framework and key aspects of Standards 
for Internal Control in the Federal Government (Principles 7, 10, and 16).5 


We also interviewed and requested information from three additional 
federal agencies: Department of State’s Bureau of Consular Affairs, 
Department of Homeland Security’s Office of Biometric and Identity 
Management, and Department of Defense’s Defense Forensic Science 
Center. We selected these agencies because multiple federal agencies 
we surveyed reported using these agencies’ systems. We also met with 
other stakeholders to discuss law enforcement use of facial recognition 
technology, including other government entities, privacy advocacy 
groups, and non-government facial recognition technology providers. For 
example, we met with the Department of Commerce’s National Institute of 
Standards and Technology, Georgetown Law Center on Privacy and 
Technology, and the International Biometrics and Identity Association. 


While we did not comprehensively assess the reliability of data provided 
by agencies and other stakeholders, we took the steps described earlier 
and considered limitations identified by the agencies. We determined that 
data elements we assessed were sufficiently reliable for the purposes of 
this report. 


The performance audit upon which this report is based was conducted 
from August 2019 to April 2021 in accordance with generally accepted 
government auditing standards. Those standards require that we plan 
and perform the audit to obtain sufficient, appropriate evidence to provide 
a reasonable basis for our findings and conclusions based on our audit 
objectives. We believe that the evidence obtained provides a reasonable 
basis for our findings and conclusions based on our audit objectives. We 
subsequently worked with the relevant entities from April 2021 to June 
2021 to prepare this version of the original sensitive report for public 
release. This public version was also prepared in accordance with these 
standards. 


5See GAO-14-704G and GAO-17-63. 
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Appendix II: Systems with Facial Recognition 
Technology Owned by Federal Agencies that 
Employ Law Enforcement Officers 


Eight of the 42 surveyed agencies reported owning systems with facial 
recognition technology. Eight summaries are presented below—that is, 
one for each of the eight agencies.1 Each summary includes a description 
of the agency’s mission, an overview of the agency’s ownership and use 
of other entities’ systems, and detailed descriptions of each system 
owned by the agency. Information in these summaries was provided by 
the respective agency. See figure 4 for an illustration of the layout of the 
summaries, including a description of each section in the summaries. 





1This appendix omits information about systems with facial recognition technology 
deemed sensitive by the respective federal agency. 
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Figure 4: Illustration of a Facial Recognition Technology Summary 
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systems sections are based on information reported by CBP. 
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System summary 

From January 2015 through March 2020, CBP reported owning two systems with 
facial recognition technology in operation—the Traveler Verification Service and 
the Automated Targeting System. According to CBP, these systems allow CBP. 
to identify travelers and provide tools to collect and disseminate information on 
individuals who could pose a risk to the country. among other things. In addition, 
CBP also used facial recognition technology owned by ather federal, state and 
local, and non-government entities 
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Traveler Verification Servi 


PURPOSE AND DESCRIPTION 


‘The Traveler Verification Service uses facial recognition 
technology to verify the identty of intemational travelers 
entering and exiting the United States.” CBP is testing 
end deploying the Traveler Verification Service in phases 
throughout the air, sea, and land travel environments 

at ports of entry. The system uses real-time capability 

to compare a travelers live proto to photos stored in 
DHS databases," such as passport photos, or to a photo 
embedded in a travel identification document. Specifically, 
the system searches DHS databases of photos 
zssociated with individuals listed on the travel manifest, 
and it then creates a prestaged “gallery” of templates 
created from those photos. CBP uses these “galleries” 

for matching purposes only and deletes them from the 
system within 12 hours. CBP plans to use fe Traveler 
Verificaton Service forall travel environments, but the 
‘gency prioritized facial recognition technology in the | 
environment. 


NUMBER OF FACIAL RECOGNITION SEARCHES. 





Year 


SYSTEM CHARACTERISTICS 





Type of searches: One-to-one and sf — wa 
One-to-many! 
tir} — 201210 
Realtime or near realtme capabilty: Yes 
10 
Includes proto database: Yes [_——$________—., 
Number of photos in database: Not applicable (see 7"? 
descristion) 02 4 ea m0 12 44 te in mo m2 m4 28 m2 30 


[Number of searches inmiions) 








‘Types of photos in database 




















* Passport photos 
+ US. entrylexit 
photos. 


+ Visa application STATUS. 
photos 

‘As of March 31, 2020, the Traveler Verification Service 
\was in operation and one extemal entity had access 
to the system. Specifically, the Transportation Seourity 
‘Administration is piloting the Traveler Verification Service 
to determine whether t can leverage the capability to. 
improve and automate securty processes. 





OTHER SYSTEM USERS (EXAMPLES) 


‘Transportation Security Administration 


"According to CBP, this system is covered by a Privacy Impact Assessment and a System of Records Notice. In addition, while 
regulations limit CBP’s collection of biometric information to certain foreign nationals entering and exiting the Lnited States, C3P's 
bometric entry-exit capabilities may also capture biometric data (facial images) from exempt foreign nationals and U.S. citizens. 
However, exemp! fereign nationels and U.S. citizens are routinely able fo “opt out" of using this technology to verity their identty and 
can instead choose a manual check of documertation for identity verification 

"Although the Traveler Verification Service system accesses photos from other DHS photo databases for matching purposes, itdoes nat 
store the photos fong-tern. The photos are deleted from the Traveler Verification Service system within 12 hours. More information on 
the Traveler Veriication Service can be found at GAO-20-568. 

By one-to-one, we mean comparing a probe phato (e.g., photo of a person of unknown or unconfirmed identity) to ancther single 

pphoto. By one-to-many, we mean compering a probe photo to two or more photos. 
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Agency seal. 
Agency name, department name, and agency’s mission. 


Number of systems owned or in procurement process at any point 
during January 1, 2015 through March 31, 2020. In addition, the 
status of these systems as of March 31, 2020. 


Description of whether agency used a system owned by another entity 
at any point during April 1, 2018 through March 31, 2020. 

System name and operational status as of March 31, 2020. 

Purpose and Description: Description of why agency has (or is 


developing or procuring) the system and how agency uses (or plans 
to use) the system. 


eo 0 000 


G —| are only included for systems in operation as of March 31, 
2020: 


© System Characteristics: Description of system search capabilities, 
real-time capabilities, photo database, and the number and type of 
photos in the database. 


@ One-to-one or one-to-many. By one-to-one, we mean 





Source: GAO. | GAO-21-518 


Page 41 


comparing a probe photo (e.g., photo of a person of unknown 
or unconfirmed identity) to another single photo. By 
one-to-many, we mean comparing a probe photo to two or 
more photos. 


Real-time capability or near real-time capability. By 
real-time capability, we mean the ability to conduct searches 
using live video streams. By near real-time capability, we 
mean the ability to conduct searches using very recently 
recorded video streams. 


© Other System Users (Examples): Examples of entities that had access 
to the system, or requested that the agency conduct a facial 
recognition search on their behalf, during January 1, 2015 through 
March 31, 2020. 

1) Number of Facial Recognition Searches: Number of searches 
conducted on the system in calendar years 2015 through 2019. 
Some searches conducted on the system may not have been for law 
enforcement purposes. 


rs) Status: Description of system status as of March 31, 2020. 
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Federal Bureau of Investigation 
Department of Justice 


The Federal Bureau of Investigation (FBI) mission is to protect the American people and 
uphold the criminal laws and the Constitution of the United States. According to the FBI, 
its priorities include protecting the United States from terrorist attacks and against foreign 
intelligence operations and espionage, and cyber operations. In addition, agency priorities 
Tareq cel=mexe}anlex=\itare mire] aliiver= lal men’ael=1ece1aiaaliar= ime (ere invam o0]e)|(emere)aae]e)i(e)ammr-larem(e)(-ralmeriaa(on 





The facial recognition technology summary and description of owned 
systems sections are based on information reported by the FBI. 


FACIAL RECOGNITION TECHNOLOGY SUMMARY 


Number of FBI systems with facial 6) Agency uses another entity’s system 
recognition technology with facial recognition technology 
iN 


In development : Other federal State, local, tribal, 
Not in use : ee 
or procurement agencies or territorial 


Ooo 













tim, = 
cw) | 
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i) 
0 
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In operation 


Non-government 





System summary 


From January 2015 through March 2020, the FBI owned six systems with facial 
recognition technology; however, only one of these systems was in operation as of 
March 31, 2020. The FBI also used facial recognition technology owned by other 
federal, state and local, and non-government entities. 
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@ Next Generation Identification Interstate Photo System 


PURPOSE AND DESCRIPTION 


The Next Generation Identification Interstate Photo 
System allows authorized law enforcement officials to 
conduct facial recognition searches using a repository 
of approximately 42.8 million photos.? To conduct a 
search, a user uploads a probe photo and the facial 
recognition software compares the probe photo 
against the repository to find likely matches. The likely 
matches are returned in a ranked candidate list of two 
to 50 photos, depending on the user’s specification. 
From 2015 through 2019, the total number of facial 
recognition searches conducted on this system was 
232,915. FBI officials reported that the system has 
assisted investigations of credit card and identity fraud, 
missing persons, bank robberies, and violent crimes, 
among others. 


SYSTEM CHARACTERISTICS 


Type of searches: One-to-many® 
Real-time or near real-time capability: No 
Includes photo database: Yes 


Number of photos in database: 42.8 million 


Types of photos in database 


¢ Mugshots 


OTHER SYSTEM USERS (EXAMPLES) 


U.S. Customs and Border Protection and state agencies 
within Arkansas, Arizona, Colorado, Delaware, Hawaii, 
lowa, Kentucky, Louisiana, Maine, Michigan, New Mexico, 
Oklahoma, South Carolina, Texas, and West Virginia. 











Source: Federal Bureau of Investigation | GAO-21-518 


NUMBER OF FACIAL RECOGNITION SEARCHES 












































40 
Number of searches (in thousands) 


STATUS 


As of March 31, 2020, the Next Generation Identification 
Interstate Photo System was in operation. 


?According to the FBI, this system is covered by a Privacy Impact Assessment and a System of Records Notice. 
5By one-to-many, we mean comparing a probe photo (e.g., photo of a person of unknown or unconfirmed identity) to two or more 


photos. 
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Federal Bureau of Investigation 


ke) a UTS 


PURPOSE AND DESCRIPTION STATUS 
FBI is using Horus, a government-off-the-shelf product, for research As of March 31, 2020, the system was being 
purposes. Specifically, FBI forensic examiners compare two images tested but was not in operation. 


to determine whether faces within the images represent the same 
individual (i.e., one-to-one comparisons). The FBI is researching Horus 
to determine whether this type of system could be incorporated into 
the FBI’s one-to-one comparisons process. For example, researching 
whether the FBI could combine the use of forensic examiners and 

a facial recognition system to improve the accuracy of one-to-one 
comparisons. The system was also used in FBI educational settings to 
demonstrate how facial recognition technology works. 





Rank One 
PURPOSE AND DESCRIPTION STATUS 
FBI is using Rank One, a government-off-the-shelf product, for As of March 31, 2020, the system was being 
research purposes. Specifically, the FBI is researching Rank One to tested but was not in operation. 


determine whether this type of system could be incorporated into the 
FBI’s one-to-one comparisons process. For example, researching 
whether the FBI could combine the use of forensic examiners and 

a facial recognition system to improve the accuracy of one-to-one 
comparisons. The system was also used in FBI educational settings 
to demonstrate how facial recognition technology works. 
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PURPOSE AND DESCRIPTION STATUS 
FBI used Automatic Face Detection and Recognition/Cluster Base, As of March 31, 2020, the system was not in 
a government-off-the-shelf product, for research purposes and for operation and no longer used for research 
educational purposes in demonstrating facial recognition technology. purposes. 
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Federal Bureau of Investigation 


| Camera with Facial Recognition Software 


PURPOSE AND DESCRIPTION STATUS 
In 2015, the FBI purchased a camera that came with facial recognition As of March 31, 2020, the facial recognition 
software. The camera is used to take driver’s license and passport technology software Was not in operation. 
photographs for undercover operations. The equipment is solely used According to the FBI, it has no plans to use 
for this purpose and the FBI has never used the facial recognition the software. 


capability that was provided with the camera. 


NeoFace Reveal 


PURPOSE AND DESCRIPTION STATUS 
FBI used NeoFace Reveal, a commercial-off-the-shelf product, As of March 31, 2020, the system was not in 
for research purposes. Specifically, the FBI was researching operation and no longer undergoing testing. 


NeoFace Reveal to determine whether this type of system could be 
incorporated into the FBI’s one-to-one comparisons process. For 
example, researching whether the FBI could combine the use of 
forensic examiners and a facial recognition system to improve the 
accuracy of one-to-one comparisons. The system was also used 

in FBI educational settings to demonstrate how facial recognition 
technology works. 
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Federal Bureau of Prisons 
Department of Justice 


The Federal Bureau of Prisons (BOP) mission is to protect society by confining offenders in 
the controlled environments of prisons and community-based facilities that are safe, humane, 
cost-efficient, and appropriately secure, and that provide work and other self-improvement 
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The facial recognition technology summary and description of owned 
systems sections are based on information reported by BOP. 


FACIAL RECOGNITION TECHNOLOGY SUMMARY 


Number of BOP systems with [aj Agency uses another entity’s system No | 
facial recognition technology with facial recognition technology 


In development ; Other federal State, local, tribal, 
Not in use ; oun! 
or procurement agencies or territorial 


CJ} tC) 








Non-government 


In operation 





System summary 


From January 2015 through March 2020, the BOP owned one system with facial 
recognition technology that was in operation. BOP did not use facial recognition 
technology owned by other federal, state or local, and non-government entities. 
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@ Facial Recognition Access Control System 





PURPOSE AND DESCRIPTION 


Facial Recognition Access Control System is used 

by BOP to authenticate entry into its secure network 
operations centers (i.e. computer rooms) at certain 
BOP facilities. Specifically, the system includes facial 
recognition technology that verifies a BOP employee’s 
identity, and once confirmed, the employee can enter 
one of BOP’s secure network operations centers. 
Roughly 131 BOP sites include the system for entry 
into secure network operations centers. 


SYSTEM CHARACTERISTICS 


Type of searches: One-to-one‘ 
Real-time or near real-time capability: No 


Includes photo database: Yes 





Number of photos in database: 8,000 
(approximately) 


Source: Federal Bureau of Prisons | GAO-21-518 


Types of photos in database 


NUMBER OF FACIAL RECOGNITION SEARCHES 
¢ Staff and contractor photos 


Unknown - According to BOP officials, they 


do not track this information. 





OTHER SYSTEM USERS (EXAMPLES) STATUS 


None As of March 31, 2020, the Facial Recognition Access 
Control System was in operation. 





‘According to the BOP, this system is covered by a Privacy Impact Assessment and a System of Records Notice. 
5By one-to-one, we mean comparing a probe photo (e.g., photo of a person of unknown or unconfirmed identity) to another single photo. 
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U.S. Customs and Border Protection 
Department of Homeland Security 


The U.S. Customs and Border Protection (CBP) mission is to safeguard America’s borders 
datz) 0)Vam 6)co)(=Yet) ale mat=m o]0] 0) [em ixelanmet=|ale(-1xel0 fom ol-lo)e)(-m- Tale m aar-1(>lare lM Vall (om=valarclaceiare miata 
nation’s global economic competitiveness by enabling legitimate trade and travel. 





The facial recognition technology summary and description of owned 
systems sections are based on information reported by CBP. 


FACIAL RECOGNITION TECHNOLOGY SUMMARY 


Number of CBP systems with facial ER Agency uses another entity’s system 
recognition technology with facial recognition technology 
aids 


In development ; Other federal State, local, tribal, 
Not in use ; Youn! 
or procurement agencies or territorial 
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Non-government 


In operation 





System summary 

From January 2015 through March 2020, CBP reported owning two systems with 
facial recognition technology in operation—the Traveler Verification Service and 
the Automated Targeting System. According to CBP, these systems allow CBP 

to identify travelers and provide tools to collect and disseminate information on 
individuals who could pose a risk to the country, among other things. In addition, 
CBP also used facial recognition technology owned by other federal, state and 
local, and non-government entities. 
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Traveler Verification Service 





KD 


PURPOSE AND DESCRIPTION 


The Traveler Verification Service uses facial recognition 
technology to verify the identity of international travelers 
entering and exiting the United States.°CBP is testing 
and deploying the Traveler Verification Service in phases 
throughout the air, sea, and land travel environments 

at ports of entry. The system uses real-time capability 

to compare a traveler’s live photo to photos stored in 
DHS databases,’ such as passport photos, or to a photo 


embedded in a travel identification document. Specifically, 


the system searches DHS databases of photos 
associated with individuals listed on the travel manifest, 
and it then creates a prestaged “gallery” of templates 
created from those photos. CBP uses these “galleries” 
for matching purposes only and deletes them from the 
system within 12 hours. CBP plans to use the Traveler 
Verification Service for all travel environments, but the 
agency prioritized facial recognition technology in the air 
environment. 


SYSTEM CHARACTERISTICS 
Type of searches: One-to-one and 
One-to-many® 
Real-time or near real-time capability: Yes 
Includes photo database: Yes 


Number of photos in database: Not applicable (see 
description) 


Types of photos in database 


e Passport photos 


¢ U.S. entry/exit 
photos 


¢ Visa application 
photos 


OTHER SYSTEM USERS (EXAMPLES) 
Transportation Security Administration 











Source: U.S. Customs and Border Protection | GAO-21-518 


NUMBER OF FACIAL RECOGNITION SEARCHES 














0 2 4 6 8 10 12 14 16 18 20 22 24 26 28 30 32 
Number of searches (in millions) 


STATUS 


As of March 31, 2020, the Traveler Verification Service 
was in operation and one external entity had access 

to the system. Specifically, the Transportation Security 
Administration is piloting the Traveler Verification Service 
to determine whether it can leverage the capability to 
improve and automate security processes. 


®According to CBP, this system is covered by a Privacy Impact Assessment and a System of Records Notice. In addition, while 
regulations limit CBP’s collection of biometric information to certain foreign nationals entering and exiting the United States, CBP’s 
biometric entry-exit capabilities may also capture biometric data (facial images) from exempt foreign nationals and U.S. citizens. 
However, exempt foreign nationals and U.S. citizens are routinely able to “opt out” of using this technology to verify their identity and 
can instead choose a manual check of documentation for identity verification. 

7Although the Traveler Verification Service system accesses photos from other DHS photo databases for matching purposes, it does not 
store the photos long-term. The photos are deleted from the Traveler Verification Service system within 12 hours. More information on 


the Traveler Verification Service can be found at GAO-20-568. 


SBy one-to-one, we mean comparing a probe photo (e.g., photo of a person of unknown or unconfirmed identity) to another single 
photo. By one-to-many, we mean comparing a probe photo to two or more photos. 
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@ Automated Targeting System 


PURPOSE AND DESCRIPTION 


CBP uses the Automated Targeting System to facilitate 
trade and travel while managing the threat posed by 
individuals and cargo entering and exiting the United 
States.° Specifically, CBP uses the system for the 
following populations: (1) individuals seeking to enter or 
exit the U.S. whose names appear on travel manifests 
(e.g., flight or vessel manifests); (2) individuals applying 
for CBP programs facilitating travel to the U.S.; and 

(3) subjects of interest who require additional research 
and analysis. CBP will match photographs for these 
three populations against a predetermined gallery of 
photographs. 





Source: U.S. Customs and Border Protection | GAO-21-518 


SYSTEM CHARACTERISTICS 
NUMBER OF FACIAL RECOGNITION SEARCHES 


Type of searches: One-to-one and 
one-to-many” Year 


Real-time or near real-time capability: Yes 2015 
Includes photo database: Yes 2016 


Number of photos in database: 15.5 million 2017 





2018 











Types of photos in database 2019 
* Passport photos + Mugshots 7 100 200 300 400 500 600 700 800 900 1,000 1,100 
umber of searches 
¢ U.S. entry/exit ¢ State identification 
photos photos 
¢ Visa application ¢ Video/Closed 
photos circuit television 
OTHER SYSTEM USERS (EXAMPLES) STATUS 
None As of March 31, 2020, the Automated Targeting System 


was in operation. 





°According to CBP, this system is covered by a Privacy Impact Assessment and a System of Records Notice. 
‘By one-to-one, we mean comparing a probe photo (e.g., photo of a person of unknown or unconfirmed identity) to another single 
photo. By one-to-many, we mean comparing a probe photo to two or more photos. 
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Transportation Security Administration 
Department of Homeland Security 


The Transportation Security Administration (TSA) mission is to protect the nation’s 
transportation systems (e.g., aviation, rail, and public transit) to ensure freedom of movement 
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The facial recognition technology summary and description of owned 
systems sections are based on information reported by TSA. 


FACIAL RECOGNITION TECHNOLOGY SUMMARY 


Number of TSA systems with facial 20 Agency uses another entity’s system 
recognition technology with facial recognition technology 
Zo 
© © &) all 


In development ; Other federal State, local, tribal, 
Not in use : sn 
or procurement agencies or territorial 


Ese ee 













em 
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Non-government 


In operation 





System summary 


From January 2015 through March 2020, TSA did not have systems with facial 
recognition technology in operation. However, during this period, the agency began 
piloting two systems—the Credential Authentication Technology-2 (CAT-2) and 

the Automated Credential Authentication Technology (AutoCAT) system. TSA is 
also partnered with the U.S. Customs and Border Protection (CBP) on a number 
of multi-phased pilots using the Traveler Verification Service, which is a system 
owned by CBP. Specifically, TSA is testing biometric solutions to automate identity 
verification functions, which are currently performed manually at TSA checkpoints. 
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Transportation Security Administration 
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PURPOSE AND DESCRIPTION STATUS 

TSA is integrating one-to-one facial matching with existing As of March 31, 2020, CAT-2 was in 
Credential Authentication Technology (CAT) machines, and referring development. TSA began conducting a 
to these machines as CAT-2. TSA will use the CAT-2 solution to demonstration of CAT-2 at Reagan National 
verify the identity of travelers who volunteer to use the technology. Airport in August 2020. At the time, TSA was 
Specifically, the volunteer traveler steps up to the CAT-2 machine also planning to conduct field test events at 
and inserts their identification document (e.g., driver’s license). The Reagan National Airport, Miami International 
CAT-2 then takes a photo of the traveler. Next, CAT-2 will match Airport, Phoenix Sky Harbor International 
the photos with the image of the traveler’s identification document Airport, Indianapolis International Airport, 
using one-to-one facial matching, and a TSA officer will direct the and a demonstration at Denver International 
traveler to the appropriate screening lane at the TSA checkpoint. Airport. 


In September 2019, TSA conducted a pilot of the CAT-2 units at 
McCarran International Airport TSA checkpoints. According to TSA 
officials, the pilot resulted in findings that will help inform future 

TSA plans and biometric requirements development, in addition to 
identifying and mitigating any performance issues and operations 
concerns. In response to the COVID-19 pandemic, TSA redesigned 
the solution to add a self-service component that allows passengers 
to scan their own identification document, which according to the 
agency, can promote social distancing. 
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PURPOSE AND DESCRIPTION STATUS 
TSA is studying AutoCAT security gates to determine whether they As of March 31, 2020, AutoCAT was in 
can, among other things, validate a traveler’s identity using one-to-one | development. TSA is validating system 
facial matching. Specifically, when a volunteer traveler approaches requirements and procuring prototypes and 
a closed AutoCAT gate, it will scan the traveler’s identification does not have additional demonstrations 
documents and take a photo of the traveler. Next, the AutoCAT will scheduled at the time. 


compare the live photo to the identification document or passport 
photo using one-to-one facial matching. If the photos match, the 
AutoCAT gate will open automatically and the traveler can pass 
through the security checkpoint. In February 2018, TSA conducted 
a 3-week demonstration of a biometric e-Gate at Los Angeles 
International Airport TSA checkpoints. According to TSA officials, 
the demonstration helped inform the design of future prototypes and 
requirements. 
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U.S. Secret Service 
Department of Homeland Security 


The U.S. Secret Service (Secret Service) carries out the integrated missions of protection 
and investigations. According to the Secret Service, its central role is in the protection of the 
nation’s leaders and the financial and critical infrastructure of the United States. 





The facial recognition technology summary and description of owned 
systems sections are based on information reported by the Secret 
Service. 


FACIAL RECOGNITION TECHNOLOGY SUMMARY 


Number of Secret Service systems 4 Agency uses another entity’s system 
with facial recognition technology with facial recognition technology 
O O ®&) all 


In development . Other federal State, local, tribal, 
Not in use : ae 
or procurement agencies or territorial 
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In operation 


Non-government 





System summary 


From January 2015 through March 2020, Secret Service reported having one 
system with facial recognition technology. Secret Service deployed this system as 
part of the Facial Recognition Pilot within the White House Complex. Following the 
pilot, Secret Service did not implement the technology. The Secret Service also 
used facial recognition technology owned by other federal, state and local, and 
non-government entities. 
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U.S. Secret Service 


Facial Recognition Pilot System 





PURPOSE AND DESCRIPTION 


According to the Secret Service, the Facial Recognition Pilot system 
was tested to determine whether it could be incorporated into the 
agency's White House Complex security operations. Specifically, 
the Secret Service stored photos of 23 volunteer employees within 
the Facial Recognition Pilot system. Next, as volunteers moved 
throughout the White House Complex, their images were captured 
by closed-circuit television cameras. In real time, the system 
compared the stored photos to images from the video footage to 
determine whether they represented the same individual. 
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STATUS 


As of March 31, 2020, the Facial Recognition 
Pilot system was not in operation and no 
longer undergoing testing by the Secret 
Service. Agency officials told us that after six 
months of data collection and subsequent 
data analysis, they decided not to use the 
system in its operations and deleted all 
stored data and photos. 
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Police Service 
Department of Veterans Affairs 


The U.S. Department of Veterans Affairs (VA) Police Service’s mission is to implement 
infrastructure protection, personal security, and law enforcement programs at VA facilities. VA 
Police Service also investigates serious incidents, conducts criminal analysis, and provides 
personal protection for the VA secretary and deputy secretary. 





The facial recognition technology summary and description of owned 
systems sections are based on information reported by the VA Police 
Service. 


FACIAL RECOGNITION TECHNOLOGY SUMMARY 


Number of VA Police Service systems 47 Agency uses another entity’s system No | 
with facial recognition technology with facial recognition technology 
Lids 

O O ®&) all 


In development ‘ State, local, tribal, 
Not in use ; ae 
or procurement agencies or territorial 
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Non-government 


In operation 





System summary 


VA Police Service reported owning two systems with facial recognition technology 
from January 2015 through March 2020. However, neither system was put into 
operation. VA Police Service was also in the process of procuring two systems for 
use at medical centers in West Palm Beach, Florida and in North Chicago, Illinois, 
during the period of our review. VA Police Service intends to use the technology to, 
among other things, locate missing patients and identify individuals with a history of 
disruption. 
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VA Police Service 
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PURPOSE AND DESCRIPTION 


Motorola Avigilon Appearance Search is a commercially available 
system with facial and weapons recognition capabilities, according 
to the VA Police Service. The VA Police Service at the Lovell Federal 
Health Care Center in North Chicago, Illinois plans to use the 
technology to sort through hours of video to quickly locate a specific 
person, such as a missing patient, or a vehicle of interest. According 
to officials, this system will also allow VA Police Service to input a 
photo from a police bulletin (e.g., ‘Be On the Lookout’ bulletin), which 
would alert officers if someone suspected of an off-campus crime 
enters the medical center campus. 


AnyVision 


STATUS 


As of March 31, 2020, the VA Police Service 
at the Lovell Federal Health Care Center 

in North Chicago was in the process of 
procuring this system. 





PURPOSE AND DESCRIPTION 


AnyVision is a commercially available system that can compare video 
footage to photos stored in a central database, according to the VA 
Police Service. The technology can search for suspects in video 
footage and display detections in a timeline. VA Police Service plans 
to use the software at the VA Medical Center at West Palm Beach to, 
among other things, respond to missing patients or those at risk of 
suicide, and to identify suspected or active threats. 


Aventura 


STATUS 


As of March 31, 2020, the VA Medical Center 
at West Palm Beach was in the process of 
procuring this system to replace Veritone 
aiWARE. 


PURPOSE AND DESCRIPTION 


The VA Police Service at the Washington, DC Medical Center planned 
to use this facial recognition technology for surveillance purposes, 
among other things. For instance, the VA Police Service placed video 
cameras at the front and back entrance of the medical center, and 
could have used the facial recognition technology to alert officers 

of the arrival of a previously disruptive individual or to track missing 
patients. 
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STATUS 


As of March 31, 2020, this system was 

not in operation. VA Police Service did not 
perform any searches on this system, and 
deactivated it in 2017. According to VA Police 
Service, the agency still possesses the 
technology and could re-activate it if desired. 
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VA Police Service 


| Veritone aiWARE 


PURPOSE AND DESCRIPTION STATUS 
The VA Medical Center at West Palm Beach has Veritone aiWARE, As of March 31, 2020, Veritone aiWARE is 
which is a web-based facial recognition system that can search not in operation. VA Medical Center at West 
for suspects in footage from all connected cameras, and display Palm Beach procured Veritone aiWARE, 
detections in a timeline, according to the VA Police Service. VA but according to VA officials, the technology 
Police Service never implemented this system, but it had planned became outdated due to delays in the 
to use it to generate investigative leads and identify unknown agency’s procurement process and delays 
individuals. For example, VA Police Service could have used related to the COVID-19 pandemic. In March 
Veritone aiWARE to alert officers of the arrival of a previously 2020, VA Police Service began procuring 
disruptive individual, or to track missing patients. AnyVision from the same vendor to replace 

this system. 
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Pentagon Force Protection Agency 
Department of Defense 


The Pentagon Force Protection Agency’s (PFPA) mission is to protect and safeguard 
designated Department of Defense (DOD) personnel, resources, and facilities. Its duties 
include law enforcement, operational security, building surveillance, crisis prevention, 
counterintelligence and anti-terrorism, and protecting high-ranking DOD officials. 





The facial recognition technology summary and description of owned 
systems sections are based on information reported by the PFPA. 


FACIAL RECOGNITION TECHNOLOGY SUMMARY 
Number of PFPA systems with 20 Agency uses another entity’s system 
facial recognition technology with facial recognition technology 
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In development ; Other federal State, local, tribal, 
Not in use : rae 
or procurement agencies or territorial 


ESE ee eS 


In operation 


Non-government 





System summary 


From January 2015 through March 2020, PFPA had two systems with facial 
recognition technology. According to officials, one of these systems was in 
operation as of March 31, 2020; however, the facial recognition technology 
component of the system was not in operation. The other system was tested once 
in 2019, but was not in operation as of March 31, 2020. PFPA has also requested 
facial recognition searches from the National Ground Intelligence Center; however, 
according to PFPA officials, they do not frequently request these searches. 
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Pentagon Force Protection Agency 





PURPOSE AND DESCRIPTION 


Briefcam is a live video synopsis tool that includes facial recognition 
technology, among other capabilities, according to PFPA. 
Specifically, PFPA operates approximately 3,000 cameras in the 
Washington, DC region, resulting in thousands of hours of video 
footage. According to PFPA officials, Briefcam can consolidate hours 
of video footage into minutes, which helps them review the footage. 
In addition, Briefcam has the capability to, among other things, 


conduct real-time facial recognition searches. 


STATUS 


As of March 31, 2020, the facial recognition 
technology component of the system was 
not in operation. Specifically, PFPA uses 
the video consolidation capabilities, but has 
not used the facial recognition technology 
accessible within Briefcam. According to 
PFPA officials, they do not plan to use 
Briefcam’s facial recognition technology in 
the future. 


PURPOSE AND DESCRIPTION 


Sirchie software is part of a remote video system used by PFPA. The 
system is aboard a mobile command center that PFPA can deploy 

to areas lacking camera infrastructure (e.g., areas at a special event 
that lack cameras). A primary function of the system is sending 
information, such as captured video, back to a central command 
center. Moreover, the system is capable of housing a facial image 
database for facial recognition searches, according to PFPA. 
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STATUS 


On one occasion, PFPA tested the facial 
recognition capability of Sirchie on four of 

its employees. However, as of March 31, 
2020, the facial recognition technology within 
Sirchie was not in operation and a photo 
database was never uploaded. According 

to PFPA officials, they do not plan to use 

this system’s facial recognition technology 
capability in the future. 
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Office of Protective Services 
National Aeronautics and Space Administration 


The Office of Protective Services provides security, fire, and medical services for National 
Aeronautics and Space Administration (NASA) facilities, personnel, and visitors. 





__ The facial recognition technology summary and description of owned systems 
sections are based on information reported by the NASA Office of Protective Services. 


FACIAL RECOGNITION TECHNOLOGY SUMMARY 


Agency uses another entity’s system | No 
with facial recognition technology 





Number of NASA Office of Protective 
Services systems with facial recognition 
technology 








O O ®) 7 
ome 
: In development . Other federal State, local, tribal, 
In operation Not in use : ee Non-government 
or procurement agencies or territorial 


ES Ee ee 





System summary 


From January 2015 through March 2020, NASA's Office of Protective Services 
participated in a proof of concept test that included the facial recognition technology 
FaceFirst. However, the technology was not deployed after it was tested. 
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NASA Office of Protective Services 


| FaceFirst 


PURPOSE AND DESCRIPTION 


NASA's Office of Protective Services worked with NASA's 
Technology and Innovation Labs to provide a proof of concept that 
included the facial recognition technology FaceFirst, a commercially 
available off-the-shelf product. The proof of concept sought to 
enhance the user experience at NASA’s forgotten badge kiosk 

by applying a facial recognition solution, which can be faster and 
more reliable than matching a driver’s license to database records, 
according to Office of Protective Services officials. In addition, the 
solution sought to eliminate the reliance on access tokens such as 
badges and enable more effective physical security. 


Page 61 


STATUS 


As of March 31, 2020, the technology was 
not in operation and was no longer being 
tested. According to agency officials, the 
cost to deploy the technology exceeded the 
budget, and there are no plans to deploy the 
technology. 
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Appendix III: Other Federal Systems with 
Facial Recognition Technology 


This appendix includes facial recognition technology summaries for three 
federal agencies: the Department of State’s Bureau of Consular Affairs, 
Department of Defense’s Defense Forensic Science Center, and the 
Department of Homeland Security’s Office of Biometric Identity 
Management. These agencies were not included in our survey. However, 
we are presenting summary descriptions because they have facial 
recognition technology that multiple surveyed agencies reported using. 
Information in the summaries were provided by the respective agency. 
The summaries use a similar format to those included in appendix II. See 
figure 4 in appendix II for an illustration of the layout of the summaries, 
including a description of each section in the summaries. 
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Bureau of Consular Affairs - Department of State 


© Integrated Biometric System 


This system description is based on information reported by the Bureau of 


Consular Affairs. 


PURPOSE AND DESCRIPTION 


The Integrated Biometric System provides the Department 

of State’s passport agencies and consular posts around the 
world with information to use in evaluating visa and passport 
applications (e.g. photos, region of residence or nationality, 
birth dates, and assigned identification number).' The system 
includes, among other things, facial recognition technology. 
State officials can use the facial recognition technology to, 

for example, verify an applicant’s identity or to determine 
whether an individual has previously applied for a visa. The 
system is generally used for non-law enforcement purposes; 
however, some federal agencies employing law enforcement 
officers conduct facial recognition searches on the system. For 
example, the Bureau of Diplomatic Security at the Department 
of State can compare a photo of an unknown individual to 
photos stored in the Integrated Biometric System to generate 
investigative leads. 


SYSTEM CHARACTERISTICS 


Type of searches: One-to-many? 
Real-time or near real-time capability: No 
Includes photo database: Yes 


Number of photos in database: 465 million 


Types of photos in database 


¢ Passport and visa ¢ Terrorist Screening 
application photos Database photos 


OTHER SYSTEM USERS (EXAMPLES) 


U.S. Customs and Border Protection, U.S. Immigration and 
Customs Enforcement, and Federal Bureau of Investigation.® 











Source: lidiia/stock.adobe.com. | GAO-21-518 


NUMBER OF FACIAL RECOGNITION SEARCHES 












































0 25 50 
Number of searchs (in millions) 


STATUS 


As of March 31, 2020, the Integrated Biometric System was in 
operation. 


‘According to the Bureau of Consular Affairs, this system is covered by a Privacy Impact Assessment and a System of Records Notice. 
?By one-to-many, we mean comparing a probe photo (e.g., photo of a person of unknown or unconfirmed identity) to two or more 


photos. 


’The Integrated Biometric System includes a passport photo gallery and a visa photo gallery, among others. While other agencies with 
access agreements can conduct their own facial recognition searches of visa galleries, only Department of State officials can access 
the passport gallery for facial recognition searches. In addition, the Department of State has an agreement with the Federal Bureau 
of Investigation (FBI) which allows the FBI to receive circumscribed results to searches done on their behalf by Department of State 


officials within the passport gallery. 
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Defense Forensic Science Center - Department of Defense 


C) Automated Biometric Identification System (ABIS) 


This system description is based on information reported by the 
Defense Forensic Science Center. 


PURPOSE AND DESCRIPTION 


The Department of Defense uses ABIS to identify known or 
suspected threat actors around the world.* The system has 
numerous capabilities, including facial recognition technology 
that may be used with the approval of a trained examiner. For 
example, the system’s facial recognition technology can match 
photos and provide a confidence score about whether faces 
within the images represent the same individual. Department 
of Defense may use ABIS to, for example, vet individuals 
requesting access to military bases abroad. 


SYSTEM CHARACTERISTICS 





Type of searches: One-to-many® Source: Defense Forensic Science Center | GAO-21-518 
Real lime Onnealtealsine capability: NG NUMBER OF FACIAL RECOGNITION SEARCHES 
Includes photo database: Yes 


Number of photos in database: 22.8 million 














Types of photos in database 





¢ Foreign nationals and U.S. citizens 
who are known or suspected 
threats 


¢ Individuals requesting access to 
military bases abroad 





0 1 
Number of searchs (in millions) 





OTHER SYSTEM USERS (EXAMPLES) STATUS 
Federal Bureau of Investigation, U.S. Customs and Border As of March 31, 2020, ABIS was in operation. According to 
Protection, U.S. Immigration and Customs Enforcement, and officials, Department of Defense began using ABIS in 2004, and 
Bureau of Diplomatic Security added facial recognition technology in 2009. 





‘According to the Department of Defense, this system is covered by a Privacy Impact Assessment and a System of Records Notice. 
5By one-to-many, we mean comparing a probe photo (e.g., photo of a person of unknown or unconfirmed identity) to two or more 
photos. 
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Office of Biometric Identity Management (OBIM) - 
Department of Homeland Security 


(.) Automated Biometric Identification System (IDENT) 


These system descriptions are based on information reported by 
the Office of Biometric Identity Management. 


PURPOSE AND DESCRIPTION 


IDENT, developed in 1994, is DHS’s primary system for 

storing and processing biometric data (e.g., facial images and 
fingerprints) and corresponding biographic data (e.g., date 

of birth). OBIM uses IDENT to offer three facial recognition 
services to partners, including federal law enforcement. These 
services allow partners to verify an individual’s identity, determine 
whether an individual in two separate photos is the same person, 
and compare a probe photo against images stored in IDENT to 
create a list of potential candidates. For example, regarding the 
candidate search service, a partner can send OBIM a photo of 
an unknown individual. Next, the photo is uploaded into IDENT 
and compared against images within IDENT’s photo repository. 
IDENT provides a list of potential matches (i.e., candidates), 
rather than a single match, for investigative leads only. 





Source: Office of Biometric Identity Management | GAO-21-518 
SYSTEM CHARACTERISTICS NUMBER OF FACIAL RECOGNITION SEARCHES 


Type of searches: One-to-one and 
one-to-many’ 
Real-time or near real-time capability: No 


Includes photo database: Yes 


Number of photos in database: 836 million 





Types of photos in database 














¢ Mugshots ¢ U.S. entry/exit ¢ Visa 
* Passport photos application 0 2 4 6 8 
photos * Credential photos Number of searchs (in millions) 
photos 
OTHER SYSTEM USERS (EXAMPLES) STATUS 

U.S. Customs and Border Protection, U.S. Immigration and As of March 31, 2020, IDENT was in operation. As discussed 
Customs Enforcement, Department of Homeland Security’s further below, DHS is developing a new system (i.e., HART), 
Office of Intelligence and Analysis, and the National which will replace IDENT. 


Counterterrorism Center 





®According to OBIM, this system is covered by a Privacy Impact Assessment and a System of Records Notice. 
"By one-to-one, we mean comparing a probe photo (e.g., photo of a person of unknown or unconfirmed identity) to another single 
photo. By one-to-many, we mean comparing a probe photo to two or more photos. 
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Office of Biometric Identity Management 


PURPOSE AND DESCRIPTION 


OBIM is developing HART, which will replace IDENT as DHS’s 
primary system for matching, storing, and sharing biometric 
information. According to OBIM, HART Increment 1 will initially 
replace IDENT’s current capabilities with a more robust, 
flexible, and scalable system that better addresses current and 
future biometric needs. In addition, Increment 2 will deliver 
multimodal fusion, as well as additional biometric services 

and enhancements, according to OBIM. Finally, according to 
OBIM, future capability development will be driven by customer 
priorities, and will include additional biometric services and 
additional biometric modalities such as DNA and Palm matching, 
among other things. 
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STATUS 


As of March 2020, HART was in development. According 

to OBIM, as of March 2021, Increment 1 is expected to be 
delivered between the first and third quarters of 2022. Once 
OBIM deems Increment 1 a success, HART will become 
operational and IDENT will be decommissioned. Increment 2 is 
expected to be deployed shortly thereafter in 2022. Additional 
capabilities will be added in subsequent years. 
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Appendix IV: Comments from the 
Department of Health and Human Services 
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3 DEPARTMENT OF HEALTH & HUMAN SERVICES OFFICE OF THE SECRETARY 
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%, 
ey, Assistant Secretary for Legislation 
wa Washington, DC 20201 
May 12, 2021 
Gretta Goodwin 


Director, Homeland Security and Justice 
U.S. Government Accountability Office 
441 G Street NW 

Washington, DC 20548 


Dear Ms. Goodwin: 


Attached are comments on the U.S. Government Accountability Office’s (GAO) report entitled, 


“Facial Recognition Technology: Federal Law Enforcement Agencies Should Better Assess 
Privacy and Other Risks” (Job code 105161/GAO-21-5 18). 


The Department appreciates the opportunity to review this report prior to publication. 


Sincerely, 


Digitally signed by Rose 
Rose M. M. Sullivan -S 


P Date: 2021.05.25 
Sullivan -S  jéos4-o400 


Rose Sullivan 
Acting Assistant Secretary for Legislation 
Principal Deputy Assistant Secretary for Legislation 


Attachment 
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GENERAL COMMENTS FROM THE DEPARTMENT OF HEALTH & HUMAN 
SERVICES ON THE GOVERNMENT ACCOUNTABILITY OFFICE’S DRAFT 
REPORT ENTITLED — FACIAL RECOGNITION TECHNOLOGY: FEDERAL LAW 
ENFORCEMENT AGENCIES SHOULD BETTER ASSESS PRIVACY AND OTHER 


RISKS (GAQ-21-518) 


The U.S. Department of Health & Human Services (HHS) appreciates the opportunity from the 
Government Accountability Office (GAO) to review and comment on this draft report. 


Recommendation 19 

The Assistant Commissioner of the Food and Drug Administration’s Office of Criminal 
Investigations should implement a mechanism to track what non-federal systems with facial 
recognition technology are used by employees to support investigative activities. 


HHS Response 
FDA concurs with this GAO recommendation, and the Food and Drug Administration’s Office 


of Criminal Investigations (OCT) intends to implement a mechanism to track what federal and 
non-federal (including state, local, tribal, territorial, and non-governmental) facial recognition 
technology (FRT) systems are used by OCI agents to support investigative activities. OCI 
intends that such tracking mechanism will include the name of the FRT system, owner of the 
FRT system, and how use of the FRT system supported OCI’s mission. 


Recommendation 20 

The Assistant Commissioner of the Food and Drug Administration’s Office of Criminal 
Investigations should, after implementing a mechanism to track non-federal systems, assess the 
risks of using such systems, including privacy and accuracy related risks. 


HHS Response 
FDA concurs with GAO’s recommendation to assess the risks of using non-federal FRT systems 


that are identified through OCT’s tracking mechanism. OCI will assemble a list of potential risks 
posed by the use of non-federal FRT systems, including risks related to privacy issues as well as 
system accuracy-related risks. OCI will use this list to help FDA identify threats to achieving 
investigative goals and objectives, and if appropriate, assist FDA in the adoption of treatment 
strategies to manage priority risks. 


Page 1 of 1 
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U.S. Department of Homeland Security 
Washington, DC 20528 


PART 


SB Homeland 
<% Security 


on. 
oy 


May 11, 2021 


Gretta L. Goodwin 

Director, Homeland Security and Justice 
U.S. Government Accountability Office 
441 G Street, NW 

Washington, DC 20548 


Re: Management Response to Draft Report GAO-21-518, “FACIAL RECOGNITION 
TECHNOLOGY: Federal Law Enforcement Agencies Should Better Assess 
Privacy and Other Risks” 


Dear Ms. Goodwin: 


Thank you for the opportunity to comment on this draft report. The U.S. Department of 
Homeland Security (DHS or the Department) appreciates the U.S. Government 
Accountability Office’s (GAO) work in planning and conducting its review and issuing 
this report. 


The Department is pleased to note GAO’s recognition that the U.S. Immigration and 
Customs Enforcement assessed privacy risks associated with its use of facial recognition 
technology, including non-federal systems, and that the agency identified privacy risks 
and possible actions to mitigate those risks. As the Department expands the use of facial 
recognition technology in its missions, DHS is committed to improved tracking of the use 
of non-Federal systems for mission purposes, as well as assessing the privacy and 
accuracy risks of utilizing such systems. 


The draft report contained 24 recommendations, including four for DHS with which the 
Department concurs. Attached find our detailed response to each recommendation. DHS 
previously submitted technical comments addressing several accuracy, contextual, and 
other issues under a separate cover for GAO’s consideration. 
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Again, thank you for the opportunity to review and comment on this draft report. Please 
feel free to contact me if you have any questions. We look forward to working with you 
again in the future. 


Sincerely, 
J IM H Digitally signed by JIM H CRUMPACKER 
Date: 05. 137: "00" 
CRUMPACKER ate: 2021.05.11 16:37:37 -04'00' 


JIM H. CRUMPACKER, CIA, CFE 
Director 
Departmental GAO-OIG Liaison Office 


Attachment 
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Attachment: Management Response to Recommendations 
Contained in GAO-21-518 


GAO recommended that the Commissioner of U.S. Customs and Border Protection 
(CBP): 


Recommendation 9: Implement a mechanism to track what non-federal systems with 
facial recognition technology are used by employees to support investigative activities. 


Response: Concur. Pursuant to CBP’s Privacy Directive 2120-010, “Privacy Policy, 
Compliance, and Implementation,” dated January 2, 2015, all CBP personnel are 
responsible for notifying the CBP Privacy Office regarding the implementation, or 
proposed implementation, of technologies that involve personally identifiable 
information (PIL) or that may otherwise impact the privacy of individuals. While 
directive 2120-010 broadly defines PII, it does not explicitly indicate that facial 
recognition technologies are potentially privacy invasive tools. The Directive also 
requires that all programs using tools, systems, and technologies—or implementing a 
program, pilot, or rulemaking—must, in coordination with the CBP Privacy Office, 
complete a Privacy Threshold Analysis to determine whether PII is involved. 


By the end of 2021, the CBP Privacy Office will update CBP’s Privacy Directive to more 
explicitly identify the applicability of these reporting and coordination requirements with 
regard to the use of facial recognition technologies, regardless of whether they are owned 
or operated by CBP. Upon approval and implementation by the Commissioner of CBP, 
the Directive will be distributed to the CBP workforce. Additionally, the CBP Privacy 
Office will create and circulate messaging specific to the use and implementation of 
facial recognition technologies to the entirety of CBP’s workforce. This increase in 
awareness should foster more active participation in CBP’s already robust Privacy 
Compliance process, reinforcing its function as a mechanism for the tracking of CBP 
systems, programs, and pilot efforts. Estimated Completion Date (ECD): December 31, 
2021. 


Recommendation 10: After implementing a mechanism to track non-federal systems, 
assess the risks of using such systems, including privacy and accuracy related risks. 


Response: Concur. CBP’s Privacy Compliance process is substantial, and includes 
reviews of IT systems, technologies, rulemakings, programs, pilot projects, and other 
activities to determine what, if any, PII is collected, used, or shared. This assessment 
allows CBP to determine whether additional policy, technological, or physical safeguards 
are necessary to ensure that data is protected from unauthorized use or disclosure. 
Increased awareness and understanding of the requirement to coordinate with the CBP 
Privacy Office, brought on by updating and publishing the Privacy Directive, will present 


3 
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new opportunities for the review of use cases and tools associated with facial recognition 
technologies that the Privacy Office may not have been previously aware. However, the 
CBP Privacy Office will also conduct training and outreach for individuals who have the 
ability to procure access to these types of vendors and technologies, via a government 
purchase card, outside of the typical IT acquisition review process. ECD: 

December 31, 2021. 


GAO recommended that the Director of the United States Secret Service (USSS): 


Recommendation 11: Implement a mechanism to track what non-federal systems with 
facial recognition technology are used by employees to support investigative activities. 


Response: Concur. The USSS Office of Investigations recognizes the importance of 
establishing visibility regarding the investigative tools utilized by agency personnel 
during the course of official investigative activities. Consequently, the Investigative 
Support Division and the Criminal Investigative Division are jointly working to enhance 
the functionality of the internal agency case management system to collect this 
information. Once established, the functional augmentation of the internal case 
management system will serve as a tracking mechanism for usage of non-federal facial 
recognition technologies. As such, the system will require USSS personnel to record the 
usage, or request for the usage, of non-federal facial recognition technology systems as 
an official investigative activity within the internal case management system. 
Specifically, the internal case management system will provide a mechanism to collect 
information about the use of facial recognition technologies used in support of 
investigative activities to include the: (1) owner and/or operator of the facial recognition 
technology system; (2) facial recognition technology system utilized; and (3) date the 
search was conducted. ECD: December 31, 2021. 


Recommendation 12: After implementing a mechanism to track non-federal systems, 
assess the risks of using such systems, including privacy and accuracy related risks. 


Response: Concur. Upon completion of the functional augmentation within the internal 
case management system, as well as implementation of the mechanism to capture usage 
of non-federal facial recognition technology systems, the USSS Office of Investigations 
will be better postured to assess the risks of using such systems. This improved visibility 
into the non-federal facial recognition technology used by agency personnel will enable 
the Office of Investigations to: (1) actively query usage of such systems; (2) ensure best 
practices for usage; and (3) assess the risks associated with privacy and/or accuracy 
deficiencies. Furthermore, the Office of Investigations will use the information garnered 
from this continual assessment to provide guidance to agency personnel as to appropriate 
usage of, or restrictions to the usage of, non-federal facial recognition technology 
systems. ECD: December 31, 2021. 
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United States Department of the Interior 


OFFICE OF THE SECRETARY 
Washington, DC 20240 





Gretta L. Goodwin 

Director, Justice and Law Enforcement Issues 
Homeland Security and Justice Team 

U.S. Government Accountability Office 

441 G Street, NW 

Washington, DC 20548 


Dear Director Goodwin, 


Thank you for providing the Department of the Interior (Department) an opportunity to review 
and comment on the draft Government Accountability Office (GAO) report entitled, Facial 
Recognition Technology: Federal Law Enforcement Agencies Should Better Assess Privacy and 
Other Risks (GAO-21-243SU). We appreciate GAO’s review and feedback related to the federal 
law enforcement use of facial recognition technology. 


The GAO issued four recommendations to the Department as part of its overall findings to 
improve these processes. The report contains two recommendations each for the U.S. Fish and 
Wildlife Service (FWS) and National Park Service (NPS). Below is a summary of actions taken 
or planned to implement the recommendations. 


Recommendation 13: “The Director of the U.S. Fish and Wildlife Service should implement 
a mechanism to track what non-federal systems with facial recognition technology are used 
by employees to support investigative activities.” 


Response: Concur. The Assistant Director, Office of Law Enforcement, entered into a licensing 
agreement with Clearview Facial Recognition Technology (FRT) on July 1, 2020, to provide all 
facial recognition requests for the FWS law enforcement needs. The FWS has limited use to two 
licensed users. Clearview’s reporting capabilities include tracking of all inquiries by license and 
case number. Clearview is the only FRT authorized for use in the FWS. Use of FRT during an 
investigation is entered into the case file in the Law Enforcement Management Information 
System (LEMIS). The Assistant Director will issue a Chief’ s Directive outlining the process for 
law enforcement personnel to request the use of facial recognition by the licensed users in cases 
requiring facial recognition. 


Responsible Official: Assistant Director, Office of Law Enforcement 


Target Date: March 1, 2022 
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Recommendation 14: “The Director of the U.S. Fish and Wildlife Service should, after 
implementing a mechanism to track non-federal systems, assess the risks of using such 
systems, including privacy and accuracy related risks.” 


Response: Concur. The Assistant Director, Office of Law Enforcement, will issue a Chief's 
Directive, in coordination with the Department’s Office of the Chief Information Officer, as 
appropriate, requiring a risk assessment of any facial recognition technology the FWS may use, 
to include an assessment of privacy and accuracy risks. 


Responsible Official: Assistant Director, Office of Law Enforcement 


Target Date: March 1, 2022 


Recommendation 15: “The Chief of the U.S. Park Police should implement a mechanism to 
track what non-federal systems with facial recognition technology are used by employees to 
support investigative activities.” 


Response: Concur. The Chief, U.S. Park Police, will establish a policy outlining a tracking 
mechanism for the use of non-federal systems with facial recognition technology used by its 
employees to support investigative activities. 


Responsible Official: Chief, U.S. Park Police 


Target Date: December 31, 2021 


Recommendation 16: “The Chief of the U.S. Park Police should, after implementing a 
mechanism to track non-federal systems, assess the risks of using such systems, including 
privacy and accuracy related risks.” 


Response: Concur. The Chief, U.S. Park Police (USPP), will issue a policy, in coordination 
with the Department’s Office of the Chief Information Officer, as appropriate, requiring a risk 
assessment of any facial recognition technology the USPP may use, to include an assessment of 
privacy and accuracy risks. 


Responsible Official: Chief, U.S. Park Police 


Target Date: March 1, 2022 
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If you have any questions or need additional information, please contact the Internal Control and 
Audit Follow-up Division of the Office of Financial Management at 
DOL PFM_ICAF@ios.doi.gov. 


Sincerely, 


Digitally signed by SHANNON 
SHANNON ESTENOZ (Affiliate) 


ESTENOZ (Affiliate) Date: 2021.03.19 10:52:42 


Shannon Estenoz 

Principal Deputy Assistant Secretary for 

Fish and Wildlife and Parks 

Exercising the Delegated Authority of the Assistant 
Secretary for Fish and Wildlife and Parks 
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United States Department of State 
Comptroller 
Washington, DC 20520 





MAR 1 0 2021 


Thomas Melito 

Managing Director 

International Affairs and Trade 
Government Accountability Office 
441 G Street, N.W. 

Washington, D.C. 20548-0001 


Dear Mr. Melito: 

We appreciate the opportunity to review your draft report, 
“FACIAL RECOGNITION TECHNOLOGY: Federal Law Enforcement 
Agencies Should Better Assess Privacy and Other Risks” GAO Job Code 
103705. 

The enclosed Department of State comments are provided for 
incorporation with this letter as an appendix to the final report. 


Sincerely, 
Pe 
Titbrrn © Moms 


Jeffrey C. Mounts 


Enclosure: 
As stated 


cc: GAO- Gretta Goodwin 
DS — Todd J. Brown 
OIG - Norman Brown 
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Department of State Comments on GAO Draft Report 


FACIAL RECOGNITION TECHNOLOGY: Federal Law Enforcement 


Agencies Should Better Assess Privacy and Other Risks 
(GAO-21-243SU, GAO Code 103705) 


Thank you for the opportunity to comment on your draft report entitled “racial 
Recognition Technology: Federal Law Enforcement Agencies Should Better Assess 
Privacy and Other Risks.” The report includes two recommendations for the 
Department of State. The Department concurs with these recommendations. 


Recommendation 17: The Assistant Secretary for Diplomatic Security (DS) 
should implement a mechanism to track what non-federal systems with facial 
recognition technology are used by employees to support investigative activities. 


Response: The Department of State agrees. The Department, through the Bureau 
of Diplomatic Security (DS), supports the need for tracking and managing access 
to “non-federal systems with facial recognition technology” and the use of these 
systems in support of DS criminal investigations. 


Prior to this study and concurrent with it, DS has been developing internal controls 
and standard operating procedures to ensure that access to any “non-federal 
systems with facial recognition technology” by DS special agents and analysts is 
properly vetted and that accounts are managed centrally through Bureau system 
account management processes. These procedures and functions are in the final 
drafting phase and are intended to be implemented this fiscal year globally. 


Recommendation 18: The Assistant Secretary for DS should, after implementing 
a mechanism to track non-federal systems, assess the risks of using such systems, 
including privacy and accuracy related risks. 


Response: The Department of State agrees. As part of the implementation of the 
controls referred to in response to Recommendation 17, DS intends to establish an 
internal review panel to evaluate and review any “non-federal systems with facial 
recognition technology” that might be used. The panel would be intended to 
centralize contracting reviews and evaluate the provider’s privacy assessments and 
practices, as well as the internal processes for data collection, in order to assess the 
risks of using such a system. DS also intends to centralize control over the 
contracts and funding to ensure users are not inadvertently encouraged by 
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providers to utilize “non-federal systems with facial recognition technology” that 
lack approval and oversight. 


The Department thanks the GAO for this constructive audit and will promptly 
implement the above recommendations. 
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DEPARTMENT OF THE TREASURY 
INTERNAL REVENUE SERVICE 
WASHINGTON, DC 20224 





DEPUTY COMMISSIONER 


March 10, 2021 


James R. McTigue, Jr 

Director, Tax Issues/Strategic Issues 

United States Government Accountability Office 
441 G Street, NW 

Washington, DC 20548 


Dear Mr. McTigue: 


Thank you for the opportunity to review the draft report of the Government 
Accountability Office entitled “Facial Recognition Technology: Federal Law Enforcement 
Agencies Should Better Assess Privacy and Other Risks” (GAO-21-243SU). The focus 
of the report is to review how federal law enforcement agencies utilize facial recognition 
technology to assist in criminal investigations. We agree with the report and its findings. 


This report includes two recommendations to each of twelve Agencies. These 
recommendations are designed to assist the Agencies in tracking what non-federal 
systems are used by employees, and to assess the risks of using these systems. With 
that as background, enclosed are comments on the draft report’s recommendations 
directed to the IRS. 


We appreciate having the opportunity to review and comment on the draft report. 
Responses to your specific recommendations are enclosed. If you have questions, 
please contact me, or a member of your staff may contact Guy Ficco, Executive Director 
of Operations, at 202-317-3804. 


Sincerely, 
a Digitally signed by Sunita B. 
Sunita B. Lough toush 


Date: 2021.03.10 17:13:23 -05'00' 


Sunita Lough 
Deputy Commissioner for Services and Enforcement 


Enclosure 
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Enclosure 


Comments on the GAO Recommendations Directed to the IRS 


Recommendation 1: 

The Chief of the Internal Revenue Service’s Criminal Investigative Division should 
implement a mechanism to track what non-federal systems with facial recognition 
technology are used by employees to support investigative activities. 


Comment: 

The IRS agrees that the Chief of the Internal Revenue Service’s Criminal Investigative 
Division (Cl) should implement a mechanism to track non-federal facial recognition 
technology systems used by employees to support investigative activities. To that end, 
requests that would involve the use of a facial recognition technology system, if carried 
out by IRS Cl’s National Forensic Laboratory (NFL), would be tracked using an 
electronic Laboratory Information Management System (LIMS). LIMS is used for 
creating, collecting, and storing all case-related information, to include database 
searches and the results of those searches, as well as equipment and technology used 
in analysis and to obtain reportable results. Furthermore, Cl’s Technology Operations 
and Investigative Services (TOIS) uses cyber security tools to monitor software and 
systems accessed on the Cl network. Therefore, the IRS has mechanisms in place 
capable of tracking non-federal facial recognition technology systems used by the IRS 
in support of investigative activities. 


It should be noted that Cl does not currently have the ability to directly access or 
connect to federal or non-federal systems with facial recognition technology capabilities. 


Recommendation 2: 

The Chief of the Internal Revenue Service’s Criminal Investigative Division should, after 
implementing a mechanism to track non-federal systems, assess the risks of using such 
systems, including privacy and accuracy related risks. 


Comment: 

The IRS agrees that the Chief of the Internal Revenue Service’s Criminal Investigative 
Division should assess the risks of using non-federal facial recognition technology 
systems, including privacy and accuracy related risks. To that end, IRS subject matter 
experts serve as members of professional organizations and groups such as the Facial 
Recognition Interagency Working Group. Active participation allows the IRS to 
continually assess risks of and best practices for using non-federal facial recognition 
technology systems. Also, documents such as the Bureau of Justice Assistance Face 
Recognition Policy Development Template are available to provide a framework under 
which a face recognition program can be operated and in a manner that complies with 
applicable laws, minimizes risks, and establishes accountability and oversight. 
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Although IRS does not currently possess or is not connected to facial recognition 
technology systems, IRS subject matter experts are already working with members of 
the relevant professional community to assess potential risks, privacy, and accuracy 
issues pertaining to the use of facial recognition technology. 
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U.S. Department of Justice 


Federal Bureau of Investigation 








Washington, D. C. 20535-0001 


March 19, 2021 


Ms. Gretta L. Goodwin 

Director 

Homeland Security and Justice 
Government Accountability Office 
441 G Street, NW 

Washington, DC 20548 


Dear Ms. Goodwin: 


Thank you for the opportunity to review and comment on the Government Accountability 
Office’s (GAO’s) draft report entitled FACIAL RECOGNITION TECHNOLOGY: Federal Law 
Enforcement Agencies Should Better Assess Privacy and Other Risks (GAO-21-243SU). The 
FBI agrees with the two recommendations addressed to the FBI Director. The FBI’s planned 
actions to address the recommendations are addressed below: 


Recommendation: The Director of the FBI should implement a mechanism to track what 
non-federal systems with facial recognition technology are used by employees to support 
investigative activities. 


FBI’s Response: 


The FBI recognizes the importance of tracking the use of facial recognition technology 
by FBI employees, contractors, and Task Force Officers and currently follows numerous policies 
governing the use of such technology, including, but not limited to, the Domestic Investigations 
and Operations Guide (DIOG) and the Next Generation Identification Policy and Implementation 
Guide. The FBI will review and, if necessary, update existing policy to ensure this GAO 
recommendation is addressed. 


Recommendation: The Director of the FBI should, after implementing a mechanism to 
track non-federal systems, assess the risks of using such systems, including privacy and accuracy 


related risks. 
FBI’s Response: 


The FBI recognizes the importance of assessing privacy and accuracy related risks 
associated with FBI use of non-federal systems with facial recognition technology and is 
committed to assessing such risks in accordance with applicable law and policy. The FBI will 
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review and, if necessary, update existing policy to ensure this GAO recommendation is 
addressed. 


Again, thank you for the opportunity to comment on this report. We look forward to 
GAO closing the recommendations that the FBI has agreed to address. 


Sincerely, 





Executive Assistant Director 
Science and Technology Branch 
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Ba 





UNITED STATES 
POSTAL SERVICE 





March 5, 2021 


Greta L. Goodwin 

Director, Homeland Security and Justice 

United States Government Accountability Office 
441 G Street, NW 

Washington, DC 20548-0001 


SUBJECT: Draft report review of Facial Technology Recognition: Federal Law Enforcement 
Agencies Should Better Assess Privacy and Other Risks (GAQ-21-243SU) — March 2021 

Dear Ms. Goodwin: 

Thank you for the opportunity to review and comment on the United States Government 
Accountability Office (GAO) draft report titled Facial Technology Recognition: Federal Law 
Enforcement Agencies Should Better Assess Privacy and Other Risks.” Our responses to the GAO's 
Recommendations for Executive Action are set forth below. 

Specific Responses 

With regard to your specific recommendations, we provide the following responses: 
Recommendation 23 

The Chief Postal Inspector of the U.S. Postal Inspection Service should implement a mechanism to 
track what non-federal systems with facial recognition technology are used by employees to support 
investigative activities. 

Management's Response — 

Management agrees in part with this recommendation. The U.S. Postal Inspection Service currently 
does track employee usage of agency-procured and provided non-federal systems with facial 
recognition technology. We will develop a mechanism to track other non-federal systems with facial 
recognition technology that our employees use to support investigative activities. | 
Expected completion date: September 30, 2021. 

Recommendation 24 

The Chief Postal Inspector of the U.S. Postal inspection Service should, after implementing a 


mechanism to track non-federal systems, assess the risks of using such systems, including privacy 
and accuracy related risks. 





475 LENFANT PLAzA SW 
WASHINGTON, DC 20260-5665 
WWW.USPS,GOV 
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Management's Response — 

Management agrees with this recommendation. Risk assessments are continuous for any system(s), 
or usage of systems, that our agency procures, to include agency-procured and provided non-federal 
systems with facial recognition technology. Upon developing a mechanism to track other non-federal 
systems with facial recognition technology that our employees use to support investigative activities, 
we will assess the risks associated to such usage. 

Expected completion date: March 31, 2022. 


The Postal Service appreciates the opportunity to respond to GAO's draft report and 
Recommendations for Executive Action. 


Sincerely, 


A a Se ee 


Gary Barksdale 
Chief Postal Inspector 


cc: Sally K. Haring, Manager, Corporate Audit and Responses 
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